---
title: "Lantronix EDS5000 CVE-2025-67038: Exploited Root RCE"
url: https://erroneo.us/security/briefs/lantronix-eds5000-cve-2025-67038-unauthenticated-rce/
description: "Unauthenticated root command injection via the login username in Lantronix EDS5000 serial servers, exploited since April 2026. Fixed in 2.2.0.0R1. Update now."
type: security-brief
section: "Security Digest"
date_published: 2026-02-20
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2025-67038"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Lantronix EDS5000 CVE-2025-67038: Exploited Root RCE

**Verdict: Patch this week.** If you run Lantronix EDS5000, G520, X300, E210 or E220 devices below the fixed firmware, update this week, and today if the web interface is reachable from untrusted networks; this is unauthenticated root code execution that attackers have used since April.

- **Who must act:** Operators of Lantronix EDS5000 serial device servers on 2.1.0.0R3 or earlier, and of G520, X300, E210 or E220 devices on firmware older than the June 2026 releases.
- **Who can relax:** Teams with no Lantronix gear, and EDS5000 owners already on 2.2.0.0R1 or later whose management interface sits on an isolated OT network.
- **Affected:** EDS5000 series (EDS5008, EDS5016, EDS5032) firmware 2.1.0.0R3 and earlier; G520 and X300 series before 2.6.0.4R6; E210 and E220 series before 3.21.0.0R1
- **Fixed:** EDS5000 firmware 2.2.0.0R1 (available since Feb 20, 2026); current release is 2.4.0.0R1; G520 and X300 firmware 2.6.0.4R6 (Jun 29, 2026); E210 and E220 firmware 3.21.0.0R1 (Jun 29, 2026)
- **CVEs:** CVE-2025-67038
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every Lantronix EDS5000, G520, X300, E210 and E220 device and record its firmware version from the web interface.
2. Update EDS5000 units to 2.2.0.0R1 or later (2.4.0.0R1 is current), and G520, X300, E210 and E220 units to the June 29, 2026 releases.
3. Block the device web interface from the internet and from business networks; allow it only from named OT admin workstations.
4. Replace default credentials and weak passwords on every device.
5. If a device was reachable and unpatched after April 5, 2026, check it as below and reflash it from trusted firmware before trusting it again.

### How to check if you are affected

- Search web, proxy or IDS logs for POSTs to /cgi-bin/luci/rpc/auth whose username contains $(, backticks, wget or curl.
- Look for luci_username values with shell syntax sent to /cgi-bin/luci/, and for calls to /cgi-bin/luci/rpc/sys or /cgi-bin/luci/rpc/uci.
- Check flow logs for traffic to or from 38.207.136.2, 154.219.113.56, 38.180.201.49 and 218.13.42.36, which Forescout observed in this activity.
- Look for request paths ending in lntxe1 through lntxea or ltrx_eds5k_rpc, and bursts of failed LuCI logins.

## What happened

The Lantronix EDS5000 is a rack-mounted serial device server with 8, 16 or 32 ports. It puts serial equipment such as PLCs, RTUs and protective relays on an IP network. It runs OpenWRT with the LuCI web interface. Forescout researchers Francesco La Spina and Stanislav Dashevskyi found that when a login fails, the LuCI JSON-RPC module writes a log line by running a shell command. The username is pasted into that command unsanitized. Per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-67038), anyone who can reach the login can run commands as root, with no password. It is scored CVSS 3.1 9.8 and CVSS 4.0 9.3.

Lantronix shipped firmware 2.2.0.0R1 on February 20, 2026. CISA's [ICS advisory ICSA-26-069-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02) followed on March 10. It also lists four authenticated command injections in the same device, CVE-2025-67034 to -67037. Forescout published its wider [BRIDGE:BREAK research](https://www.forescout.com/blog/exploiting-serial-to-ethernet-converters-in-critical-infrastructure/) on April 21. It covers 22 new flaws in Lantronix and Silex serial-to-IP converters.

Exploitation started before that. [Forescout reported](https://www.forescout.com/blog/analyzing-active-exploitation-of-lantronix-and-openwrt-luci/) on June 25 that a cluster it calls Chaya_006 hit its EDS5000 honeypot from April 5. It sent `$(sleep 5)` probes in the username to `/cgi-bin/luci/rpc/auth`, then tried to make the device fetch files tagged `lntxe1` to `lntxea`. Activity continued until June 3. Forescout thinks the attackers "may have reverse-engineered the patch." Forescout told [SecurityWeek](https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/) the activity "was not consistent with a typical botnet." CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-67038) on June 23 and gave federal agencies three days, until June 26. On June 29, [Lantronix](https://www.lantronix.com/security-advisories/cve-2025-67038/) confirmed the same bug in its G520, X300, E210 and E220 product lines and shipped fixes.

## Who is affected

EDS5000 firmware 2.1.0.0R3 and earlier. G520 and X300 before 2.6.0.4R6. E210 and E220 before 3.21.0.0R1. Lantronix's [EDS5000 firmware page](https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/Latest+Firmware+for+the+EDS5000+series+EDS5008+EDS5016+EDS5032) now lists 2.4.0.0R1 as current. One caution: even the October 2026 revision of the ICS advisory still says no known public exploitation was reported to CISA. Go by the KEV listing and Forescout's honeypot data instead.

## Do you really need to act?

Yes, if you run these devices on old firmware. The bug needs no credentials, gives root, and has been used against real targets. A compromised unit gives an attacker root right next to the control equipment it serves. Exploitation looks targeted rather than mass, and most organizations own none of these products. That is why the verdict is patch this week, not drop everything. If the web interface is reachable from the internet or a flat corporate network, treat it as urgent today.

## What to do now

1. Inventory Lantronix EDS5000, G520, X300, E210 and E220 devices and note each firmware version.
2. Update EDS5000 units to 2.2.0.0R1 or later, and the other lines to the June 29 releases. Lantronix notes that when upgrading to 2.1.0.0R3 or later through the web, you should uncheck "keep settings" to avoid a failed upgrade.
3. Remove internet exposure and restrict the web interface to OT admin workstations.
4. Replace default and weak passwords.

## How to tell if you were hit

Search web, proxy and IDS logs for POSTs to `/cgi-bin/luci/rpc/auth` with `$(`, backticks, `wget` or `curl` in the username. Also look for shell syntax in `luci_username` sent to `/cgi-bin/luci/`, such as `admin$(id)`, and calls to `/cgi-bin/luci/rpc/sys`. Check flow logs for `38.207.136.2`, `154.219.113.56`, `38.180.201.49` and `218.13.42.36`. Forescout says the scanning addresses are likely compromised devices, so absence is not proof. Any hit means reflashing the device and reviewing what sits behind it.

## Timeline

- Feb 20, 2026 — Lantronix releases EDS5000 firmware 2.2.0.0R1.
- Mar 10, 2026 — CISA publishes ICSA-26-069-02.
- Apr 5, 2026 — First exploitation seen on Forescout's honeypot.
- Apr 21, 2026 — Forescout publishes BRIDGE:BREAK.
- Jun 23, 2026 — CISA adds the CVE to KEV, due June 26.
- Jun 25, 2026 — Forescout details the Chaya_006 activity.
- Jun 29, 2026 — Lantronix publishes fixes for G520, X300, E210 and E220.

## Sources

1. [Lantronix — Security advisory: CVE-2025-67038](https://www.lantronix.com/security-advisories/cve-2025-67038/)
2. [Lantronix — Latest firmware for the EDS5000 series (EDS5008, EDS5016, EDS5032)](https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/Latest+Firmware+for+the+EDS5000+series+EDS5008+EDS5016+EDS5032)
3. [CISA — ICSA-26-069-02: Lantronix EDS3000PS and EDS5000 (Update B)](https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02)
4. [CVE record — CVE-2025-67038](https://www.cve.org/CVERecord?id=CVE-2025-67038)
5. [NVD — CVE-2025-67038](https://nvd.nist.gov/vuln/detail/CVE-2025-67038)
6. [CISA — Known Exploited Vulnerabilities: CVE-2025-67038](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-67038)
7. [Forescout Vedere Labs — Analyzing active exploitation of Lantronix and OpenWRT LuCI](https://www.forescout.com/blog/analyzing-active-exploitation-of-lantronix-and-openwrt-luci/)
8. [Forescout Vedere Labs — BRIDGE:BREAK: Exploiting serial-to-Ethernet converters in critical infrastructure](https://www.forescout.com/blog/exploiting-serial-to-ethernet-converters-in-critical-infrastructure/)
9. [SecurityWeek — Lantronix Serial-to-IP Converter Flaw Exploited in Attacks](https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/)
10. [The Hacker News — CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited](https://thehackernews.com/2026/06/cisa-warns-critical-lantronix-eds5000.html)

---
Source page: https://erroneo.us/security/briefs/lantronix-eds5000-cve-2025-67038-unauthenticated-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt