CVE-2025-67038: critical vulnerability in Lantronix E210 series
Lantronix EDS5000, G520, and X300 OS Command Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
The Lantronix EDS5000 device allows attackers to run arbitrary commands as root by injecting malicious code into the username field during login attempts. An attacker can gain complete control of the device without needing valid credentials.
CWE-94 (Improper Control of Generation of Code) via OS command injection in the HTTP RPC module's log-writing mechanism. The username parameter is concatenated unsanitized into a shell command executed during failed authentication, allowing unauthenticated remote code execution with root privileges. No special conditions are required beyond network access to the HTTP interface.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.