Lantronix EDS5000 2

Lantronix EDS5000 is a serial-to-Ethernet device server — the small black box that bridges legacy RS-232/485 equipment (PLCs, HMIs, building controls, medical devices, point-of-sale terminals) onto IP networks. CVE-2025-67038 is a classic CWE-94 command injection: the HTTP RPC handler writes a log line on failed authentication and shell-concatenates the supplied username directly into the command. No credential is required — the bug triggers on the *failed* auth path. Affected firmware is EDS5000 2.1.0.0R3 and earlier; fixed in 2.2.0.0R1. The EDS3000PS line is also implicated per the parallel ICS advisory.

Vendor severity of 9.8 CRITICAL matches reality here, and the reassessment holds it there. This is exactly the pattern that justifies the label: unauthenticated, network-reachable, single HTTP request, root execution, on a device whose entire purpose is to sit at the seam between trusted serial endpoints and routable IP networks. CISA added it to KEV on 2026-06-23 with a federal patch-by date of 2026-06-26 — there is no friction story that lowers this.

Why this verdict

• Pre-auth + root + single request — the cheapest possible exploitation profile; no credential, no chain, no user interaction.
• KEV listing as of 2026-06-23 with federal patch deadline 2026-06-26 — CISA does not list speculative bugs; this is being weaponized now.
• Role multiplier: EDS5000 is canonically a serial-to-Ethernet bridge into OT/ICS, building automation, medical, and retail environments. Chain succeeds in every deployment role and ends in MITM on the industrial protocol — fleet-scale blast radius within any OT estate. Verdict floor is CRITICAL.
• Low EPSS is misleading here — EPSS lags KEV by weeks on embedded-device CVEs because public PoC publication trails private exploitation.
• Patch friction is real — embedded firmware upgrades require maintenance windows on production OT, which is exactly why compensating controls matter immediately.

Why not higher?

CRITICAL is the top bucket. There is no higher rating; the only thing that would intensify this is a wormable component, and HTTP-based device-server attacks don't self-propagate without an additional discovery primitive.

Why not lower?

Every plausible downgrade lever fails. The bug is unauthenticated, the affected product is purpose-built to live at sensitive network seams, KEV proves active exploitation, and EPSS — the usual lever for downgrading low-percentile bugs — is overridden by direct evidence of in-the-wild use.

1. Block management ports at the network edge today — ACL TCP/80, 443, and 9999 inbound from any untrusted segment to every EDS5000/EDS3000PS. This is the noisgate mitigation SLA action — deploy within 3 days (CRITICAL) but realistically within hours given KEV active-exploitation status.
2. Move device servers behind a jump host or VPN — Management plane should be reachable only from a hardened admin VLAN. Apply within the same 3-day window; this also buys time for the firmware upgrade rollout.
3. Inventory all Lantronix devices via SNMP sweep and DHCP logs — Most orgs underestimate their EDS footprint because OT/facilities teams procure them outside IT. Complete inventory within 7 days to scope the patch campaign.
4. Enable syslog forwarding to SIEM with alerts on auth-failure spikes and oversized username fields — The exploit pattern is a malformed username in a failed login. Even basic regex detection on the forwarded log catches it. Deploy concurrent with the network ACL.
5. Upgrade firmware to 2.2.0.0R1 in coordinated maintenance windows — noisgate remediation SLA for CRITICAL is ≤ 90 days, but KEV listing pulls this forward — target full fleet patched within 30 days with priority to any unit reachable from corporate or external networks.

Run from an auditor workstation on the same routable segment as the target device. Requires network reachability only — no credentials. Invoke as ./check-eds5000.sh 10.20.30.40 against each Lantronix IP. Safe (no injection payload sent); reads only the login banner and version string.

#!/usr/bin/env bash
# noisgate verification — CVE-2025-67038 Lantronix EDS5000
# Output: VULNERABLE / PATCHED / UNKNOWN
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <ip-or-host>" >&2
  exit 2
fi

UA="noisgate-verifier/1.0"
PORTS=(80 443 9999)
FIXED_MAJOR=2; FIXED_MINOR=2; FIXED_REV=0

fetch() {
  local proto=$1 port=$2
  curl -ksS --max-time 5 -A "$UA" "${proto}://${TARGET}:${port}/" 2>/dev/null
}

BANNER=""
for p in "${PORTS[@]}"; do
  proto=http; [[ $p == 443 ]] && proto=https
  B=$(fetch "$proto" "$p")
  if [[ -n "$B" ]]; then BANNER="$B"; break; fi
done

if [[ -z "$BANNER" ]]; then
  echo "UNKNOWN: no HTTP response from ${TARGET} on ports ${PORTS[*]}"
  exit 3
fi

if ! grep -qiE "lantronix|EDS[0-9]+" <<< "$BANNER"; then
  echo "UNKNOWN: target does not fingerprint as Lantronix EDS"
  exit 3
fi

# Extract firmware version like 2.1.0.0R3 or 2.2.0.0R1
VER=$(grep -oE "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+R[0-9]+" <<< "$BANNER" | head -n1)
if [[ -z "$VER" ]]; then
  echo "UNKNOWN: Lantronix device detected but firmware version not parseable from banner"
  exit 3
fi

MAJ=${VER%%.*}; rest=${VER#*.}
MIN=${rest%%.*}; rest=${rest#*.}
REV=${rest%%.*}

if   (( MAJ >  FIXED_MAJOR )); then STATUS=PATCHED
elif (( MAJ <  FIXED_MAJOR )); then STATUS=VULNERABLE
elif (( MIN >= FIXED_MINOR )); then STATUS=PATCHED
else STATUS=VULNERABLE
fi

echo "${STATUS}: ${TARGET} firmware ${VER} (fixed ≥ 2.2.0.0R1)"
[[ $STATUS == VULNERABLE ]] && exit 1 || exit 0

Sources

1. CISA ICS Advisory ICSA-26-069-02 — Lantronix EDS3000PS and EDS5000
2. CISA KEV addition (2026-06-23)
3. The Hacker News — CISA Warns Critical Lantronix EDS5000 Flaw Actively Exploited
4. SecurityWeek — Critical Ubiquiti/Lantronix Vulnerabilities in Attackers' Crosshairs
5. BleepingComputer — CISA warns of max severity flaws exploited in attacks
6. SecurityAffairs — CISA adds Ubiquiti UniFi OS and Lantronix EDS5000 to KEV
7. SecurityOnline — CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV
8. CloudKey Blog — Attackers Reach Root on UniFi OS and Lantronix Edge Servers