NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Lantronix EDS5000 command injection CVE-2025-67038 exploited; fixes available

Attackers use CVE-2025-67038 to take over Lantronix EDS5000 equipment without signing in. Four other Lantronix families are affected. Fixes are available for all five; ask IT to update firmware and restrict management access.

What to do

Ask your IT provider to update EDS5000 to 2.2.0.0R1 or later, G520/X300 to 2.6.0.4R6 or later, and E210/E220 to 3.21.0.0R1 or later. Restrict management access to trusted networks behind a firewall, and have exposed devices checked for compromise.

What’s happening

CVE-2025-67038 lets an attacker who can reach an affected device's web management service run operating-system commands with full administrator privileges, without signing in. The flaw affects Lantronix EDS5000 equipment, which connects serial devices to networks, and four router and gateway families. It mishandles usernames when recording failed login attempts. EDS5000 fixes were available in February, before public disclosure in March and exploitation that Forescout observed on a decoy device in April. CISA confirmed exploitation through its June catalogue listing. Lantronix supplied the remaining product-family fixes on 29 June. In October, FortiGuard Labs reported exploitation by ClingSTUN malware, so available patches have not ended attacks on unpatched devices. The reviewed reports do not establish a total number of victims or an end to exploitation. Lantronix rates the flaw high; the ICS-CERT CNA rating shown by NVD is critical, with a CVSS 4.0 score of 9.3.

What
Flaw
Affects
Lantronix EDS5000 device servers, G520 and X300 gateways, and E210 and E220 routers
Affected
EDS5000 series: firmware 2.1.0.0R3 and earlier
G520 series: firmware before 2.6.0.4R6
X300 series: firmware before 2.6.0.4R6
E210 series: firmware before 3.21.0.0R1
E220 series: firmware before 3.21.0.0R1
Fixed in
EDS5000 series: 2.2.0.0R1
G520 series: 2.6.0.4R6
X300 series: 2.6.0.4R6
E210 series: 3.21.0.0R1
E220 series: 3.21.0.0R1
CVE
CVE-2025-67038
Since
23 June 2026
Closed
5 Oct 2026

Timeline

  1. Wider attacks

    FortiGuard Labs reported that the ClingSTUN malware campaign also exploited CVE-2025-67038. The malware turns compromised devices into remotely controlled network relays and maintains access across restarts.

  2. New fixFixed

    Lantronix published fixes for G520 and X300 in 2.6.0.4R6, and E210 and E220 in 3.21.0.0R1. Its advisory marked the vulnerability fixed across all five affected families.

  3. CISA added

    CISA added CVE-2025-67038 to its Known Exploited Vulnerabilities catalogue, with a 26 June remediation deadline for US federal agencies.

  4. Made public

    Forescout published its BRIDGE:BREAK research, detailing this flaw among vulnerabilities in serial-to-network equipment.

  5. Update

    Forescout observed exploitation against an unpatched EDS5000 decoy device. It later grouped this targeted activity under the name Chaya_006.

  6. Made public

    CVE-2025-67038 was published in the National Vulnerability Database, before Forescout's detailed research report.

  7. New fixPartly fixed

    Lantronix released EDS5000 firmware 2.2.0.0R1 addressing the flaw. Fixes for four other affected product families followed in June.

Sources

  1. CVE-2025-67038Lantronix · 29 June 2026
  2. Analyzing Active Exploitation of Lantronix and OpenWRT LuCIForescout · 25 June 2026
  3. Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat WarningSecurityWeek · 25 June 2026
  4. CVE-2025-67038 DetailNIST NVD · 8 Sept 2026
  5. ClingSTUN Linux Backdoor Abuses Public STUN InfrastructureFortiGuard Labs · 5 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from June 2026 · JSON · RSS