CVE-2025-67038

The HTTP RPC module of Lantronix EDS5000 devices executes a shell command to save logs in case of failed user authentication. The username provided by the client is directly appended to this command without any validation or sanitization (CWE-94 – improper code injection). An attacker can therefore construct an appropriately crafted username field value that will cause arbitrary system commands to be executed. The entire process occurs without the need to possess any credentials – the vulnerability is exploitable over the network, without authentication.

An attacker gains the ability to execute arbitrary operating system commands with root privileges, which means complete takeover of the device, including the ability to read and modify data, install malicious software, and disrupt service operations.

Apply patches available from the vendor according to the references. Detailed information is contained in the CISA ICS advisory ICSA-26-069-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02). Until updates are applied, it is recommended to restrict network access to the HTTP interface of devices only to trusted hosts (e.g., using a firewall or network segmentation).

Lantronix EDS5032 Firmware, Lantronix EDS5032, Lantronix EDS5008 Firmware, Lantronix EDS5008, Lantronix EDS5016 Firmware – software version 2.1.0.0R3 (EDS5000 series)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.