CVE-2025-67038
Lantronix EDS5000, G520, and X300 OS Command Injection
CVE-2025-67038 is a critical vulnerability (CVSS 9.3) in Lantronix Eds5000, published March 11, 2026. CISA lists it as known to be exploited, since June 23, 2026. EUVD reports exploitation since June 23, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 21.1%, the 97th percentile. No source names a fixed version.
- Severity
- 9.3 CriticalCVSS 4.0, CVE List
- Exploit chance
- 21.1%EPSS, 97th percentile
- Exploitation
- ExploitedCISA KEV,
- Fixed in
- No fix listedNo source names one
Description
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
- lantronix eds5000
- lantronix e210 series
- lantronix e213f102s firmware
- lantronix e214f002s firmware
- lantronix e214f00cs firmware
- lantronix e214g000s firmware
- lantronix e214g001s firmware
- lantronix e218f004s firmware
- lantronix e218g107s firmware
- lantronix e220 series
- lantronix e228g002s firmware
- lantronix e228g004s firmware
Show 27 moreShow less
- lantronix e228g00cb28 firmware
- lantronix e228g00cs firmware
- lantronix eds5000 series
- lantronix eds5008 firmware
- lantronix eds5016 firmware
- lantronix eds5032 firmware
- lantronix g520 series
- lantronix g526gp12s firmware
- lantronix g526gp17s firmware
- lantronix g526gp1as firmware
- lantronix g526gp1asg firmware
- lantronix g526gp1cs firmware
- lantronix g527gp22s firmware
- lantronix g527gp27s firmware
- lantronix g527gp2as firmware
- lantronix g527gp2asg firmware
- lantronix g528gp2fs firmware
- lantronix g528gp2fsg firmware
- lantronix g528gp2fsgc firmware
- lantronix x300 series
- lantronix x300f202s firmware
- lantronix x303f202s firmware
- lantronix x304g000s firmware
- lantronix x304g002s firmware
- lantronix x304g007s firmware
- lantronix x304g00as firmware
- lantronix x304g00cs firmware
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | HORKimhab/CVE-2025-67038 | 2026-06-25 |
What each source reports
CVE List Score used
Lantronix EDS5000, G520, and X300 OS Command Injection
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
- Record
CVE-2025-67038- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2025-208587
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
- Record
EUVD-2025-208587- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-55gq-23mv-cw8r
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell...
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
- Record
GHSA-55gq-23mv-cw8r- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78, CWE-94
- Updated
- 2026-11-02
CISA KEVNo score
Lantronix EDS5000 Code Injection Vulnerability
Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
- Record
CVE-2025-67038- Weakness
- CWE-78, CWE-94
- Updated
- 2026-11-02
NVD
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
- Record
CVE-2025-67038- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw
cisa.gov/news-events/ics-advisories/icsa-26-069-02
github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json
nvd.nist.gov/vuln/detail/CVE-2025-67038
eds5000.com
lantronix.com