CVE-2025-67038 Lantronix EDS5000 Code Injection Exploitation

let eds5000_ips = dynamic([]);
let suspicious_patterns = dynamic(['cmd=', 'exec=', 'command=', ';ls', ';id', ';cat', '|sh', '|bash', '`', '%60', '%3B', '%7C', '../', '..%2F']);
let timeframe = 1h;
union DeviceNetworkEvents, CommonSecurityLog, AzureActivity
| where TimeGenerated >= ago(timeframe)
| extend DestPort = coalesce(DestinationPort, toint(DeviceCustomNumber1))
| where DestPort in (80, 443, 8080, 9999, 30718)
| extend RequestURL = coalesce(RequestURL, DestinationServiceName, tostring(AdditionalExtensions))
| where RequestURL has_any (suspicious_patterns)
  or (RequestURL has_any ('/cgi-bin/', '/admin/', '/manage/') and RequestURL has_any ('=', '?'))
| extend SourceIP = coalesce(SourceIP, DeviceAddress, CallerIpAddress)
| extend DestIP = coalesce(DestinationIP, DeviceTranslatedAddress)
| project TimeGenerated, SourceIP, DestIP, DestPort, RequestURL, DeviceVendor, DeviceProduct, Activity
| extend RiskScore = case(
    RequestURL has_any (';id', ';ls', '|sh', '|bash', '`'), 90,
    RequestURL has_any ('%3B', '%7C', '%60'), 80,
    RequestURL has_any ('../', '..%2F'), 70,
    50
  )
| where RiskScore >= 50
| order by RiskScore desc, TimeGenerated desc

index=* (sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype="juniper:junos:firewall" OR sourcetype=access_combined OR sourcetype=httpevent)
| eval dest_port=coalesce(dest_port, dpt)
| where dest_port IN (80, 443, 8080, 9999, 30718)
| eval uri=coalesce(uri, request, cs-uri-stem)
| eval query_string=coalesce(uri_query, cs-uri-query, qs)
| eval full_request=uri."."query_string
| where match(full_request, "(/cgi-bin/|/admin/|/manage/|/config/)")
    OR match(full_request, "(;ls|;id|;cat|;pwd|;whoami|;wget|;curl|;nc |\|sh|\|bash)")
    OR match(full_request, "(%3B|%7C|%60|%24%28)")
    OR match(full_request, "(\.\./|\.\.[/\\\\])")
| eval src_ip=coalesce(src_ip, src, c-ip)
| eval dest_ip=coalesce(dest_ip, dest, s-ip)
| eval risk_score=case(
    match(full_request, "(;id|;ls|\|sh|\|bash)"), 90,
    match(full_request, "(%3B|%7C|%60)"), 80,
    match(full_request, "(\.\./)"), 70,
    true(), 50
  )
| where risk_score >= 50
| stats count, earliest(_time) as first_seen, latest(_time) as last_seen, values(full_request) as requests, max(risk_score) as max_risk by src_ip, dest_ip, dest_port
| where count >= 1
| sort - max_risk, - count

sequence by source.ip with maxspan=5m
  [network where destination.port in (80, 443, 8080, 9999, 30718)
   and (
     url.path like~ "*/cgi-bin/*" or
     url.path like~ "*/admin/*" or
     url.path like~ "*/manage/*" or
     url.path like~ "*/config/*"
   )
   and (
     url.query like~ "*;*" or
     url.query like~ "*|*" or
     url.query like~ "*`*" or
     url.query like~ "*%3B*" or
     url.query like~ "*%7C*" or
     url.query like~ "*%60*" or
     url.full like~ "*../"
   )
  ]
  [network where destination.port in (80, 443, 8080, 9999, 30718)
   and event.action in ("connection_attempted", "connection_accepted")
  ]

SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  starttime,
  eventcount,
  QIDNAME(qid) as event_name
FROM events
WHERE
  logsourcetypename(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Juniper Networks Firewall', 'Palo Alto PA Series')
  AND destinationport IN (80, 443, 8080, 9999, 30718)
  AND (
    URL ILIKE '%/cgi-bin/%'
    OR URL ILIKE '%/admin/%'
    OR URL ILIKE '%/manage/%'
    OR URL ILIKE '%/config/%'
  )
  AND (
    URL ILIKE '%;%'
    OR URL ILIKE '%|%'
    OR URL ILIKE '%`%'
    OR URL ILIKE '%%3B%'
    OR URL ILIKE '%%7C%'
    OR URL ILIKE '%%60%'
    OR URL ILIKE '%../%'
  )
  AND LOGSOURCENAME(logsourceid) NOT ILIKE '%scanner%'
  AND LOGSOURCENAME(logsourceid) NOT ILIKE '%pentest%'
LAST 1 HOURS
ORDER BY starttime DESC

_sourceCategory=firewall* OR _sourceCategory=webserver* OR _sourceCategory=network*
| where !("scanner" in _sourceHost) and !("pentest" in _sourceHost)
| parse regex field=_raw "(?i)(?:GET|POST|PUT|PATCH)\s+(?P<request_uri>\S+)" nodrop
| parse regex field=_raw "(?i)dest(?:ination)?[_\s]?port[=:\s]+(?P<dest_port>\d+)" nodrop
| where dest_port in ("80", "443", "8080", "9999", "30718")
| where request_uri matches "*/cgi-bin/*"
  or request_uri matches "*/admin/*"
  or request_uri matches "*/manage/*"
  or request_uri matches "*/config/*"
| where request_uri matches "*;*"
  or request_uri matches "*|*"
  or request_uri matches "*%3B*"
  or request_uri matches "*%7C*"
  or request_uri matches "*%60*"
  or request_uri matches "*../*"
| parse regex field=_raw "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| eval risk_level = if(request_uri matches "*;id*" or request_uri matches "*;ls*" or request_uri matches "*|sh*", "CRITICAL", "HIGH")
| count as attempt_count, last(_messageTime) as last_seen by src_ip, dest_port, risk_level
| sort by attempt_count desc

rule cve_2025_67038_lantronix_eds5000_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-67038 code injection exploitation against Lantronix EDS5000 series"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-67038"
    created = "2026-06-23"

  events:
    $req.metadata.event_type = "NETWORK_HTTP"
    $req.target.port in (80, 443, 8080, 9999, 30718)
    (
      re.regex($req.network.http.request_url, `(?i)/(cgi-bin|admin|manage|config)/`)
    )
    (
      re.regex($req.network.http.request_url, `;(ls|id|cat|pwd|whoami|wget|curl|nc |sh|bash)`) or
      re.regex($req.network.http.request_url, `\|(ls|id|sh|bash|python|perl)`) or
      re.regex($req.network.http.request_url, `(%3B|%7C|%60|%24%28)`) or
      re.regex($req.network.http.request_url, `\.\./`)
    )

  condition:
    $req
}

#event_simpleName=NetworkConnectIP4
| dest_port_number in [80, 443, 8080, 9999, 30718]
| join type=inner
  [
    #event_simpleName=ProcessRollup2
    | CommandLine = /(?i)(wget|curl|nc|ncat|bash|sh|python|perl).*(?:lantronix|eds5000|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/
    | eval is_suspicious_process = 1
  ]
  [aid, TargetProcessId]
| union
  [
    #event_simpleName=NetworkConnectIP4
    | dest_port_number in [80, 443, 8080, 9999, 30718]
    | LocalAddressIP4 = /\d+\.\d+\.\d+\.\d+/
    | eval connection_count = count(dest_port_number)
    | where connection_count > 10
  ]
| fields aid, ComputerName, UserName, LocalAddressIP4, RemoteAddressIP4, dest_port_number, FileName, CommandLine, timestamp
| sort timestamp desc