What’s Vulnerable › Vulnerabilities

CVE-2025-67038: Lantronix EDS5000 Code Injection Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-06-23
• EPSS: 20.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-11 · updated 2026-09-08
• Weakness: CWE-78

Description

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

Affected products

• LANTRONIX E213F102S Firmware: before 3.21.0.0R1 — fixed in 3.21.0.0R1
• LANTRONIX E214F002S Firmware: before 3.21.0.0R1 — fixed in 3.21.0.0R1
• LANTRONIX E214F00Cs Firmware: before 3.21.0.0R1 — fixed in 3.21.0.0R1
• LANTRONIX E214G000S Firmware: before 3.21.0.0R1 — fixed in 3.21.0.0R1
• LANTRONIX E214G001S Firmware: before 3.21.0.0R1 — fixed in 3.21.0.0R1
• LANTRONIX E218F004S Firmware: before 3.21.0.0R1 — fixed in 3.21.0.0R1
• LANTRONIX E218G107S Firmware: before 3.21.0.0R1 — fixed in 3.21.0.0R1
• LANTRONIX E228G002S Firmware: before 3.21.0.0R1 — fixed in 3.21.0.0R1
• LANTRONIX E228G004S Firmware: before 3.21.0.0R1 — fixed in 3.21.0.0R1
• LANTRONIX E228G00Cb28 Firmware: before 3.21.0.0R1 — fixed in 3.21.0.0R1
• LANTRONIX E228G00Cs Firmware: before 3.21.0.0R1 — fixed in 3.21.0.0R1
• LANTRONIX Eds5008 Firmware: before 2.2.0.0r1 — fixed in 2.2.0.0r1
• LANTRONIX Eds5016 Firmware: before 2.2.0.0r1 — fixed in 2.2.0.0r1
• LANTRONIX Eds5032 Firmware: before 2.2.0.0r1 — fixed in 2.2.0.0r1
• LANTRONIX G526Gp12S Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX G526Gp17S Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX G526Gp1As Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX G526Gp1Asg Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX G526Gp1Cs Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX G527Gp22S Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX G527Gp27S Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX G527Gp2As Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX G527Gp2Asg Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX G528Gp2Fs Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX G528Gp2Fsg Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX G528Gp2Fsgc Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX X300F202S Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX X303F202S Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX X304G000S Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6
• LANTRONIX X304G002S Firmware: before 2.6.0.4R6 — fixed in 2.6.0.4R6

How to fix

Upgrade to a fixed version: LANTRONIX E213F102S Firmware 3.21.0.0R1; LANTRONIX E214F002S Firmware 3.21.0.0R1; LANTRONIX E214F00Cs Firmware 3.21.0.0R1; LANTRONIX E214G000S Firmware 3.21.0.0R1; LANTRONIX E214G001S Firmware 3.21.0.0R1; LANTRONIX E218F004S Firmware 3.21.0.0R1; LANTRONIX E218G107S Firmware 3.21.0.0R1; LANTRONIX E228G002S Firmware 3.21.0.0R1; LANTRONIX E228G004S Firmware 3.21.0.0R1; LANTRONIX E228G00Cb28 Firmware 3.21.0.0R1; LANTRONIX E228G00Cs Firmware 3.21.0.0R1; LANTRONIX Eds5008 Firmware 2.2.0.0r1. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02
• https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-67038

Get alerted when CVE-2025-67038 or the next vulnerability affects your stack