CVE-2025-67038

critical

Description

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json

https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/

https://www.securityweek.com/critical-ubiquiti-vulnerabilities-in-attackers-crosshairs/

https://www.bleepingcomputer.com/news/security/cisa-warns-of-max-severity-ubiquiti-flaws-exploited-in-attacks/

https://thehackernews.com/2026/06/cisa-warns-critical-lantronix-eds5000.html

https://securityaffairs.com/194142/security/u-s-cisa-adds-ubiquiti-unifi-os-and-lantronix-eds5000-plugin-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2026/06/23/cisa-adds-four-known-exploited-vulnerabilities-catalog

https://thehackernews.com/2026/04/22-bridgebreak-flaws-expose-20000.html

https://github.com/angelvalentin-cyber/vulnerability-research

https://github.com/VixianSchool/nuclei-cve-check

https://github.com/HORKimhab/CVE-2025-67038

https://github.com/HORKimhab/poc-cve-collection

https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-67038

Details

Source: Mitre, NVD

Published: 2026-03-11

Updated: 2026-09-08

Named Vulnerability: BRIDGE:BREAKKnown Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: Critical

EPSS

EPSS: 0.1432