erroneo.us
Search all guides⌘K

Security Digest · Feb 20, 2026 · Vulnerability · Network edge

Lantronix EDS5000 CVE-2025-67038: Exploited Root RCE

Unauthenticated root command injection via the login username in Lantronix EDS5000 serial servers, exploited since April 2026. Fixed in 2.2.0.0R1. Update now.

Published By erroneo.us Security Desk · Updated 3 min read10 sources

Our verdict

Patch this week

If you run Lantronix EDS5000, G520, X300, E210 or E220 devices below the fixed firmware, update this week, and today if the web interface is reachable from untrusted networks; this is unauthenticated root code execution that attackers have used since April.

Who must act: Operators of Lantronix EDS5000 serial device servers on 2.1.0.0R3 or earlier, and of G520, X300, E210 or E220 devices on firmware older than the June 2026 releases.

Who can relax: Teams with no Lantronix gear, and EDS5000 owners already on 2.2.0.0R1 or later whose management interface sits on an isolated OT network.

Affected
EDS5000 series (EDS5008, EDS5016, EDS5032) firmware 2.1.0.0R3 and earlier
G520 and X300 series before 2.6.0.4R6
E210 and E220 series before 3.21.0.0R1
Fixed in
EDS5000 firmware 2.2.0.0R1 (available since Feb 20, 2026); current release is 2.4.0.0R1
G520 and X300 firmware 2.6.0.4R6 (Jun 29, 2026)
E210 and E220 firmware 3.21.0.0R1 (Jun 29, 2026)
CVSS
9.8 (v3.1, CNA)
EPSS
20.0% (percentile 97)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. List every Lantronix EDS5000, G520, X300, E210 and E220 device and record its firmware version from the web interface.
  2. Update EDS5000 units to 2.2.0.0R1 or later (2.4.0.0R1 is current), and G520, X300, E210 and E220 units to the June 29, 2026 releases.
  3. Block the device web interface from the internet and from business networks; allow it only from named OT admin workstations.
  4. Replace default credentials and weak passwords on every device.
  5. If a device was reachable and unpatched after April 5, 2026, check it as below and reflash it from trusted firmware before trusting it again.

How to check if you are affected or compromised

  • Search web, proxy or IDS logs for POSTs to /cgi-bin/luci/rpc/auth whose username contains $(, backticks, wget or curl.
  • Look for luci_username values with shell syntax sent to /cgi-bin/luci/, and for calls to /cgi-bin/luci/rpc/sys or /cgi-bin/luci/rpc/uci.
  • Check flow logs for traffic to or from 38.207.136.2, 154.219.113.56, 38.180.201.49 and 218.13.42.36, which Forescout observed in this activity.
  • Look for request paths ending in lntxe1 through lntxea or ltrx_eds5k_rpc, and bursts of failed LuCI logins.

What happened#

The Lantronix EDS5000 is a rack-mounted serial device server with 8, 16 or 32 ports. It puts serial equipment such as PLCs, RTUs and protective relays on an IP network. It runs OpenWRT with the LuCI web interface. Forescout researchers Francesco La Spina and Stanislav Dashevskyi found that when a login fails, the LuCI JSON-RPC module writes a log line by running a shell command. The username is pasted into that command unsanitized. Per the CVE record, anyone who can reach the login can run commands as root, with no password. It is scored CVSS 3.1 9.8 and CVSS 4.0 9.3.

Lantronix shipped firmware 2.2.0.0R1 on February 20, 2026. CISA's ICS advisory ICSA-26-069-02 followed on March 10. It also lists four authenticated command injections in the same device, CVE-2025-67034 to -67037. Forescout published its wider BRIDGE:BREAK research on April 21. It covers 22 new flaws in Lantronix and Silex serial-to-IP converters.

Exploitation started before that. Forescout reported on June 25 that a cluster it calls Chaya_006 hit its EDS5000 honeypot from April 5. It sent $(sleep 5) probes in the username to /cgi-bin/luci/rpc/auth, then tried to make the device fetch files tagged lntxe1 to lntxea. Activity continued until June 3. Forescout thinks the attackers "may have reverse-engineered the patch." Forescout told SecurityWeek the activity "was not consistent with a typical botnet." CISA added the CVE to KEV on June 23 and gave federal agencies three days, until June 26. On June 29, Lantronix confirmed the same bug in its G520, X300, E210 and E220 product lines and shipped fixes.

Who is affected#

EDS5000 firmware 2.1.0.0R3 and earlier. G520 and X300 before 2.6.0.4R6. E210 and E220 before 3.21.0.0R1. Lantronix's EDS5000 firmware page now lists 2.4.0.0R1 as current. One caution: even the October 2026 revision of the ICS advisory still says no known public exploitation was reported to CISA. Go by the KEV listing and Forescout's honeypot data instead.

Do you really need to act?#

Yes, if you run these devices on old firmware. The bug needs no credentials, gives root, and has been used against real targets. A compromised unit gives an attacker root right next to the control equipment it serves. Exploitation looks targeted rather than mass, and most organizations own none of these products. That is why the verdict is patch this week, not drop everything. If the web interface is reachable from the internet or a flat corporate network, treat it as urgent today.

What to do now#

  1. Inventory Lantronix EDS5000, G520, X300, E210 and E220 devices and note each firmware version.
  2. Update EDS5000 units to 2.2.0.0R1 or later, and the other lines to the June 29 releases. Lantronix notes that when upgrading to 2.1.0.0R3 or later through the web, you should uncheck "keep settings" to avoid a failed upgrade.
  3. Remove internet exposure and restrict the web interface to OT admin workstations.
  4. Replace default and weak passwords.

How to tell if you were hit#

Search web, proxy and IDS logs for POSTs to /cgi-bin/luci/rpc/auth with $(, backticks, wget or curl in the username. Also look for shell syntax in luci_username sent to /cgi-bin/luci/, such as admin$(id), and calls to /cgi-bin/luci/rpc/sys. Check flow logs for 38.207.136.2, 154.219.113.56, 38.180.201.49 and 218.13.42.36. Forescout says the scanning addresses are likely compromised devices, so absence is not proof. Any hit means reflashing the device and reviewing what sits behind it.

Timeline#

  • — Lantronix releases EDS5000 firmware 2.2.0.0R1.
  • — CISA publishes ICSA-26-069-02.
  • — First exploitation seen on Forescout's honeypot.
  • — Forescout publishes BRIDGE:BREAK.
  • — CISA adds the CVE to KEV, due June 26.
  • — Forescout details the Chaya_006 activity.
  • — Lantronix publishes fixes for G520, X300, E210 and E220.

Vulnerability records

  • CVE-2025-67038 · KEV 2026-06-23 · An issue was discovered in Lantronix EDS5000 2.1.0.0R3.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Lantronix — Security advisory: CVE-2025-67038 lantronix.com
  2. Lantronix — Latest firmware for the EDS5000 series (EDS5008, EDS5016, EDS5032) ltrxdev.atlassian.net
  3. CISA — ICSA-26-069-02: Lantronix EDS3000PS and EDS5000 (Update B) cisa.gov
  4. CVE record — CVE-2025-67038 cve.org
  5. NVD — CVE-2025-67038 nvd.nist.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2025-67038 cisa.gov
  7. Forescout Vedere Labs — Analyzing active exploitation of Lantronix and OpenWRT LuCI forescout.com
  8. Forescout Vedere Labs — BRIDGE:BREAK: Exploiting serial-to-Ethernet converters in critical infrastructure forescout.com

Coverage and analysis

  1. SecurityWeek — Lantronix Serial-to-IP Converter Flaw Exploited in Attacks securityweek.com
  2. The Hacker News — CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited thehackernews.com