Lantronix EDS5000 Remote OS Command Injection Vulnerability (CVE-2025-67038) Security Advisory

1. Apply Official Firmware Update

Immediately upgrade the device firmware to the latest secure version provided by Lantronix.

2. Temporary Mitigations

If immediate patching is not feasible, implement the following defensive measures:

• Restrict Management Access: Block external WAN access to the HTTP (80) and HTTPS (443) management ports of the device.
• Network Segmentation: Isolate the EDS5000 devices within a dedicated management VLAN and restrict access using Access Control Lists (ACLs) to authorized administrator IPs only.
• WAF/IDS Signature Deployment: Deploy signatures to detect and block HTTP POST requests to the RPC endpoint containing shell metacharacters in the username parameter.

  # Example Snort/Suricata Detection Rule
  alert tcp any any -> any (msg:"Lantronix EDS5000 Command Injection Attempt"; flow:established,to_server; content:"/rpc"; http_uri; pcre:"/username=[^&]*[;`|\$\(\)]/Ui"; sid:1000001; rev:1;)

A critical OS Command Injection vulnerability (CWE-78) has been identified in the HTTP RPC module of Lantronix EDS5000 device servers.

The root cause lies in the authentication failure logging mechanism. When a user authentication attempt fails, the HTTP RPC module executes a system shell command to write logs. During this process, the input provided in the username parameter is directly concatenated into the shell command without proper sanitization or input validation.

An unauthenticated attacker can exploit this by injecting shell metacharacters (such as ;, &, or ` ``) followed by malicious commands into the username field of an authentication request. Because the injected commands are executed with root privileges, successful exploitation leads to complete system compromise. This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.