Lantronix EDS5000, G520, and X300 OS Command Injection
Affects Lantronix EDS5000 series 2.1.0.0R3 and earlier, G520 and X300 below 2.6.0.4R6, and E210 and E220 below 3.21.0.0R1. EDS5000 is fixed in 2.2.0.0R1.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 2.6.0.4R6, 3.21.0.0R1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The vulnerability affects Lantronix EDS5000, G520, and X300 device firmware, specifically the HTTP RPC module's login-failure logging function. An attacker can inject arbitrary operating system commands through the username field, and those commands run with root privileges, giving the attacker full control over the affected device.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Lantronix EDS5000 series
through 2.1.0.0R3
- Lantronix G520 series
fixed in 2.6.0.4R6
- Lantronix X300 series
fixed in 2.6.0.4R6
- Lantronix E210 series
fixed in 3.21.0.0R1
- Lantronix E220 series
fixed in 3.21.0.0R1
References 3
GitHub · cisagov/CSAF
Questions about CVE-2025-67038
What does this mean?
An attacker could bypass authentication and execute code with root-level privileges. The flaw is an OS command injection in these Lantronix devices.Source: cisa.gov
Am I affected, and how do I check?
EDS5000 series version 2.1.0.0R3 and earlier, G520 series below 2.6.0.4R6, X300 series below 2.6.0.4R6, E210 series below 3.21.0.0R1, and E220 series below 3.21.0.0R1 are listed as affected. Compare the firmware version on the device against these version numbers.Source: cisa.gov
What should I do about it?
For EDS5000 series, upgrade to version 2.2.0.0R1 or later. For G520 and X300 series, install 2.6.0.4R6 or later, and for E210 and E220 series, install 3.21.0.0R1 or later.Source: cisa.gov
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-06-23, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data