What Happened

On June 23, 2026, CISA added CVE-2025-67038 to its Known Exploited Vulnerabilities catalog as part of an alert covering four newly added flaws. The vulnerability carries a CVSS score of 9.8 and affects Lantronix EDS5000 series serial-to-IP converters running firmware version 2.1.0.0R3. The flaw exists in the device’s HTTP RPC module, which concatenates the username parameter directly into a shell command used for logging failed authentication attempts without sanitization. An unauthenticated remote attacker can inject arbitrary OS commands via the username field and execute them with root privileges. CISA set a remediation deadline of June 26, 2026 for Federal Civilian Executive Branch agencies. Lantronix released firmware version 2.2.0.0R1 to address the vulnerability. The flaw was originally disclosed in April 2026 by Forescout Research Vedere Labs as part of the BRIDGE:BREAK collection of serial device vulnerabilities affecting Lantronix and Silex hardware.

Why It Matters

Serial-to-IP converters occupy a high-value position at the boundary between IT and operational technology networks. They provide remote management access to serial-attached network equipment, industrial controllers, and embedded devices. An unauthenticated attacker who achieves root on one of these devices can intercept serial management traffic for adjacent network gear, pivot into downstream OT environments, or establish persistent access to management infrastructure that is typically excluded from standard endpoint monitoring coverage.

Analyst Note

The vulnerability class here, user input concatenated into OS commands without sanitization, is a recurring pattern in embedded and OT firmware, where authentication logging code and non-primary application paths are often less rigorously reviewed during development. Organizations managing IT/OT boundary devices should audit any firmware that performs string construction for shell operations involving user-supplied parameters.

For context on network device credential exposure enabling broader attacks, see CyberTech’s coverage of the FortiBleed campaign targeting FortiGate firewalls.

Source: CISA