CVE-2025-67038 is a critical OS command injection vulnerability affecting Lantronix EDS5000 series serial-to-Ethernet device servers. An unauthenticated remote attacker can achieve root-level system compromise by injecting arbitrary shell commands via the username parameter. With a CVSS score of 9.8 and confirmed active exploitation in the wild, the flaw enables full device takeover and potential lateral movement into sensitive industrial or management networks. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal remediation by June 26, 2026.

• Vulnerability Overview: CVE-2025-67038

  • Affects the Lantronix EDS5000 series of serial-to-Ethernet device servers.
  • Classified as a critical OS command injection flaw with a CVSS score of 9.8.
  • Requires no prior authentication, allowing remote attackers to target exposed management interfaces.

• Technical Deep Dive: Attack Mechanics

  • The vulnerability resides in the handling of the username parameter during authentication requests.
  • Failure to sanitize input allows attackers to append shell metacharacters and execute arbitrary commands.
  • Exploitation grants the attacker immediate root-level privileges, bypassing all local security controls.

• Operational Impact and Exploitation

  • Confirmed active exploitation in the wild indicates high threat actor interest.
  • Compromised devices can be used as beachheads for lateral movement into internal OT (Operational Technology) or ICS networks.
  • Full system compromise allows for data interception, configuration modification, and persistent backdoor installation.

• Regulatory Pressure and Mandates

  • CISA officially added the vulnerability to the KEV catalog on June 23, 2026.
  • Triggered by BOD 26-04, federal agencies were issued a strict 3-day remediation mandate.
  • Deadline for mandatory patching or mitigation was set for June 26, 2026.

• Detection and Mitigation Strategies

  • Immediate deployment of the latest firmware updates provided by Lantronix.
  • Implementation of strict Access Control Lists (ACLs) to isolate management interfaces from untrusted networks.
  • Monitoring for anomalous outbound traffic or unexpected shell execution patterns originating from EDS5000 hardware.