Lantronix EDS5000 HTTP RPC Username Command Injection

Successful exploitation allows unauthenticated remote code execution as root on the affected EDS5000 device. An attacker can fully compromise the appliance, execute arbitrary commands, alter configuration, tamper with logs, establish persistence, pivot further into the environment, disrupt serial communications, and potentially manipulate connected operational or industrial workflows that depend on the device.

If immediate patching is not possible, remove affected EDS5000 management interfaces from direct internet exposure, restrict network access to trusted administrative hosts only, place the device behind firewalls or VPN-gated access, segment it from business and untrusted networks, and monitor for suspicious authentication attempts or anomalous process execution. Review logs and device state for signs of exploitation, especially failed authentication events containing unusual username values. These measures reduce exposure but do not eliminate the underlying flaw.

Upgrade Lantronix EDS5000 from affected version 2.1.0.0R3 to a vendor-provided fixed release that addresses CVE-2025-67038. Apply Lantronix security updates for the EDS5000 series and follow vendor guidance for validating the update. Because this vulnerability has been added to CISA's Known Exploited Vulnerabilities Catalog, organizations should prioritize patching on an urgent basis and perform post-remediation compromise assessment as appropriate.