Skip to content
Fencer Vulns
critical 9.8

CVE-2025-67038 kev in the critical feed json

Lantronix EDS5000, G520, and X300 OS Command Injection

published 2026-03-11 8 mo ago modified 2026-09-08 2 mo ago also EUVD-2025-208587

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2026-06-23
epss
21.1%
EPSS 21.1% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

Patch / fix

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

  • Lantronix EDS5000 series 2.2.0.0R1
  • Lantronix G520 series 2.6.0.4R6
  • Lantronix X300 series 2.6.0.4R6
  • Lantronix E210 series 3.21.0.0R1
  • Lantronix E220 series 3.21.0.0R1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-069-02 updated cvss 9.8

Lantronix EDS3000PS and EDS5000 (Update B)

  • Lantronix E210 series <3.21.0.0R1 Lantronix E220 series <3.21.0.0R1
    affected: fixed in 3.21.0.0R1, mitigation “For more information or technical assistance, contact Lantronix support (Support@lantronix.com).” lantronix.com
  • Lantronix EDS5000 series <=2.1.0.0R3
    affected: fixed in 2.2.0.0R1, mitigation “For more information or technical assistance, contact Lantronix support (Support@lantronix.com).” lantronix.com
  • Lantronix G520 series <2.6.0.4R6 Lantronix X300 series <2.6.0.4R6
    affected: fixed in 2.6.0.4R6, mitigation “For more information or technical assistance, contact Lantronix support (Support@lantronix.com).” lantronix.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA SSVC: exploitation active
  4. CISA patch deadline

Known exploited

Added
4 mo ago
Patch by
2026-06-26 (4 mo ago)
Ransomware
Not known
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor, product
Lantronix, EDS5000
CISA name
Lantronix EDS5000 Code Injection Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
4 mo ago

Exploit prediction

21.15% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Lantronix EDS5000 series
  • Lantronix G520 series
  • Lantronix X300 series
  • Lantronix E210 series
  • Lantronix E220 series

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.