{"id":"lantronix-eds5000-command-injection-jun-2026","category":"patch","status":"closed","title":"Lantronix EDS5000 command injection CVE-2025-67038 exploited; fixes available","tldr":"Attackers use CVE-2025-67038 to take over Lantronix EDS5000 equipment without signing in. Four other Lantronix families are affected. Fixes are available for all five; ask IT to update firmware and restrict management access.","summary":"CVE-2025-67038 lets an attacker who can reach an affected device's web management service run operating-system commands with full administrator privileges, without signing in. The flaw affects Lantronix EDS5000 equipment, which connects serial devices to networks, and four router and gateway families. It mishandles usernames when recording failed login attempts. EDS5000 fixes were available in February, before public disclosure in March and exploitation that Forescout observed on a decoy device in April. CISA confirmed exploitation through its June catalogue listing. Lantronix supplied the remaining product-family fixes on 29 June. In October, FortiGuard Labs reported exploitation by ClingSTUN malware, so available patches have not ended attacks on unpatched devices. The reviewed reports do not establish a total number of victims or an end to exploitation. Lantronix rates the flaw high; the ICS-CERT CNA rating shown by NVD is critical, with a CVSS 4.0 score of 9.3.","action":"Ask your IT provider to update EDS5000 to 2.2.0.0R1 or later, G520/X300 to 2.6.0.4R6 or later, and E210/E220 to 3.21.0.0R1 or later. Restrict management access to trusted networks behind a firewall, and have exposed devices checked for compromise.","product":"Lantronix EDS5000 device servers, G520 and X300 gateways, and E210 and E220 routers","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2025-67038"],"tags":["lantronix","eds5000","command-injection","actively-exploited","industrial","clingstun"],"affected":["EDS5000 series: firmware 2.1.0.0R3 and earlier","G520 series: firmware before 2.6.0.4R6","X300 series: firmware before 2.6.0.4R6","E210 series: firmware before 3.21.0.0R1","E220 series: firmware before 3.21.0.0R1"],"fixed":["EDS5000 series: 2.2.0.0R1","G520 series: 2.6.0.4R6","X300 series: 2.6.0.4R6","E210 series: 3.21.0.0R1","E220 series: 3.21.0.0R1"],"matches":[],"sources":[{"kind":"advisory","title":"CVE-2025-67038","url":"https://www.lantronix.com/security-advisories/cve-2025-67038/","by":"Lantronix","date":"2026-06-29"},{"kind":"research","title":"Analyzing Active Exploitation of Lantronix and OpenWRT LuCI","url":"https://www.forescout.com/blog/analyzing-active-exploitation-of-lantronix-and-openwrt-luci/","by":"Forescout","date":"2026-06-25"},{"kind":"news","title":"Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning","url":"https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/","by":"SecurityWeek","date":"2026-06-25"},{"kind":"advisory","title":"CVE-2025-67038 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2025-67038","by":"NIST NVD","date":"2026-09-08"},{"kind":"research","title":"ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure","url":"https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure","by":"FortiGuard Labs","date":"2026-10-05"}],"started":"2026-06-23","closed":"2026-10-05","created":"2026-11-03T22:25:34.708Z","updated":"2026-11-03T22:25:34.708Z","cve_notes":[{"cve":"CVE-2025-67038","name":"Unauthenticated command injection in Lantronix web login","what":"The web login service mishandles usernames when logging failed sign-ins, allowing an attacker to run commands with full administrator privileges on affected Lantronix devices.","severity":"high","cvss":9.3}],"timeline":[{"at":"2026-10-05","added":"2026-11-03T22:22:59.664Z","kind":"wider-attacks","text":"FortiGuard Labs reported that the ClingSTUN malware campaign also exploited CVE-2025-67038. The malware turns compromised devices into remotely controlled network relays and maintains access across restarts.","url":"https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure","by":"FortiGuard Labs","patch":null},{"at":"2026-06-29","added":"2026-11-03T22:22:59.664Z","kind":"new-fix","text":"Lantronix published fixes for G520 and X300 in 2.6.0.4R6, and E210 and E220 in 3.21.0.0R1. Its advisory marked the vulnerability fixed across all five affected families.","url":"https://www.lantronix.com/security-advisories/cve-2025-67038/","by":"Lantronix","patch":"patched"},{"at":"2026-06-23","added":"2026-11-03T22:22:59.664Z","kind":"cisa-added","text":"CISA added CVE-2025-67038 to its Known Exploited Vulnerabilities catalogue, with a 26 June remediation deadline for US federal agencies.","url":"https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/","by":"SecurityWeek","patch":null},{"at":"2026-04-21","added":"2026-11-03T22:22:59.664Z","kind":"disclosed","text":"Forescout published its BRIDGE:BREAK research, detailing this flaw among vulnerabilities in serial-to-network equipment.","url":"https://www.forescout.com/blog/analyzing-active-exploitation-of-lantronix-and-openwrt-luci/","by":"Forescout","patch":null},{"at":"2026-04-05","added":"2026-11-03T22:22:59.664Z","kind":"other","text":"Forescout observed exploitation against an unpatched EDS5000 decoy device. It later grouped this targeted activity under the name Chaya_006.","url":"https://www.forescout.com/blog/analyzing-active-exploitation-of-lantronix-and-openwrt-luci/","by":"Forescout","patch":null},{"at":"2026-03-11","added":"2026-11-03T22:22:59.664Z","kind":"disclosed","text":"CVE-2025-67038 was published in the National Vulnerability Database, before Forescout's detailed research report.","url":"https://www.forescout.com/blog/analyzing-active-exploitation-of-lantronix-and-openwrt-luci/","by":"Forescout","patch":null},{"at":"2026-02-20","added":"2026-11-03T22:22:59.664Z","kind":"new-fix","text":"Lantronix released EDS5000 firmware 2.2.0.0R1 addressing the flaw. Fixes for four other affected product families followed in June.","url":"https://www.lantronix.com/security-advisories/cve-2025-67038/","by":"Lantronix","patch":"partial"}],"url":"https://hard.fyi/live/lantronix-eds5000-command-injection-jun-2026/","json":"https://hard.fyi/api/live?id=lantronix-eds5000-command-injection-jun-2026"}