CVE-2025-67038: Active Exploitation of Lantronix EDS5000 Code Injection Vulnerability

Vulnerability Overview

CVE-2025-67038 is a code injection vulnerability affecting Lantronix EDS5000 series device servers, classified under CWE-78 (OS Command Injection) and CWE-94 (Code Injection). The flaw exists in the device management interface, where insufficient input validation allows an attacker to inject arbitrary OS commands or code. Successful exploitation grants an attacker the ability to execute commands on the underlying operating system, potentially achieving full device compromise, lateral movement into connected serial devices, or disruption of industrial and enterprise network operations.

Affected Products

This vulnerability affects the Lantronix EDS5000 series of serial-to-network device servers, which includes the following models commonly deployed in industrial control and enterprise environments:

• EDS5008
• EDS5016
• EDS5032

No specific firmware versions have been enumerated in the advisory at time of writing, and no patch date has been confirmed. Defenders should treat all deployed EDS5000 units as potentially vulnerable until Lantronix issues remediation guidance.

Exploitation Status

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. KEV listing is a high-confidence signal that threat actors have weaponized this flaw against real targets. Given the EDS5000's role as a serial gateway — bridging legacy OT/serial equipment to IP networks — exploitation may serve as an initial access vector into environments that would otherwise be air-gapped or segmented. Defenders should treat any exploitation attempt as high-severity and respond accordingly, particularly in industrial or critical infrastructure contexts.

Detection Coverage

Our detection for CVE-2025-67038 ships query logic across seven SIEM platforms, covering the full breadth of enterprise and cloud-native security stacks:

• Microsoft Sentinel (KQL) — correlates network events and management-plane traffic targeting EDS5000 interfaces, flagging anomalous command patterns indicative of injection attempts.
• Splunk (SPL) — hunts for suspicious HTTP requests to device management endpoints and command execution artifacts sourced from serial device server IP ranges.
• Elastic (EQL) — sequences network and process events to surface injection payloads reaching EDS5000 management services.
• IBM QRadar (AQL) — queries flow and log data for known exploitation signatures targeting Lantronix management interfaces.
• Sumo Logic — rules correlate log sources for unusual outbound connections or command execution originating from device server management IPs.
• Chronicle (YARA-L) — UDM-based rules match on entity behavior and network telemetry consistent with CVE-2025-67038 exploitation patterns.
• CrowdStrike (CQL) — endpoint and network telemetry rules detect post-exploitation activity stemming from compromised EDS5000 devices reaching adjacent hosts.

The detection logic focuses on identifying malformed or command-laden requests to the EDS5000 management interface, unexpected process spawning from device server processes, and anomalous outbound sessions initiated post-exploitation. Given the KEV status, tuning thresholds toward sensitivity over specificity is recommended until the environment is confirmed clean.

Recommended Defensive Actions

• Inventory all Lantronix EDS5000 devices in your environment immediately.
• Restrict management interface access to trusted IP ranges via firewall or ACL.
• Monitor for and alert on any inbound HTTP/HTTPS traffic to EDS5000 management ports from untrusted sources.
• Apply vendor patches as soon as Lantronix publishes remediation; subscribe to their security advisories.
• Treat any KEV-listed device with internet-accessible management interfaces as compromised until proven otherwise.

Full detection queries for all seven SIEM platforms, along with playbook guidance and atomic test cases for validating coverage, are available on the CVE-2025-67038 detection page. Paid subscribers receive the complete purple team package including adversary simulation steps and response runbooks.