> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning - URL: https://f4n6.co.uk/security-feed/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/ - Published: 2026-06-25T12:05:20.000Z - Updated: 2026-06-25T12:05:20.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2025-67038 ## 1\. Executive summary CISA added CVE-2025-67038 (CVSS 9.8 CRITICAL, CWE-94 Code Injection) to its Known Exploited Vulnerabilities (KEV) catalog on 2026-06-23, confirming active in-the-wild exploitation of Lantronix EDS5000 Series serial-to-IP device servers. The flaw permits an unauthenticated attacker to inject arbitrary OS commands via a username parameter, executing them with root privileges. The vulnerability was originally disclosed in April 2026 by Forescout as part of the BRIDGE:BREAK research project, which identified 20 serial-to-IP vulnerabilities across Lantronix and Silex products. EMEA financial services with OT dependencies (data-centre HVAC, UPS, building management systems) should treat internet-exposed serial-to-IP converters as immediate compromise candidates. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | Active exploitation of CVE-2025-67038 confirmed by CISA KEV listing; financial institutions running Lantronix EDS5000 devices must treat this as a confirmed ICT-related incident. | Institutions must activate incident management processes for any affected device, including identification, containment, and remediation tracking. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | CVSS 9.8 CRITICAL, CISA KEV-listed, active exploitation — this meets the threshold for classification as a major incident. | Requires formal classification and severity grading within the institution's incident taxonomy. | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | If a financial institution confirms a compromised Lantronix EDS5000 device on its estate, the criticality and active exploitation status likely elevate this to a major ICT-related incident requiring authority notification. | Confirmed compromises on financial-sector infrastructure must be reported to the competent authority within established timelines. | | DORA Art. 28: ICT third-party risk — general principles | Lantronix is a third-party ICT provider; the vulnerability is in a third-party-supplied device. | Institutions must verify that Lantronix has provided remediation and that contractual provisions support timely patching. | | NIS2 Art. 21(2)(d): supply chain security measures | The vulnerability originates in a third-party OT component (Lantronix EDS5000) within the supply chain. | NIS2-covered entities must assess and address vulnerabilities in ICT products supplied by third parties. | | UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties | If a Lantronix EDS5000 device supports an essential service (e.g., data-centre environmental controls), OES/RDSP operators have duties to secure it. | Operators of essential services running affected devices must remediate under UK NIS obligations. | ## 3\. Technical analysis & attack chain ### Vulnerability: CVE-2025-67038 - **CVSS:** 9.8 CRITICAL (authoritative — VERIFIED REFERENCE DATA) - **CWE:** CWE-94 (Code Injection) — authoritative from verified data - **CISA KEV:** Added 2026-06-23; federal agency remediation due 2026-06-26 - **EPSS:** 1% — indicating low exploitation probability scoring, though CISA has confirmed active exploitation notwithstanding this metric - **Affected product:** Lantronix EDS5000 Series serial-to-IP device servers - **Authentication:** None required — unauthenticated attacker - **Injection vector:** OS command injection via a username parameter - **Execution context:** Root privileges ### Attack chain (confirmed steps from source material) 1. **Reconnaissance:** Attacker identifies an internet-exposed Lantronix EDS5000 device. ZoomEye indicates thousands of internet-exposed Lantronix systems exist, though this aggregate includes all Lantronix product lines and the count of specifically vulnerable EDS5000 units is unclear. 2. **Initial exploitation:** Unauthenticated attacker sends a request to the EDS5000 device, injecting arbitrary OS commands into the username parameter. Commands execute with root privileges due to the device's service context. 3. **Foothold establishment:** The compromised device becomes a network foothold. The attacker gains full control of the device. 4. **Command and control:** The attacker establishes a C2 channel to remotely manage the compromised device and issue further commands. 5. **Lateral movement:** The attacker moves laterally from the compromised device to target other connected systems within the network. 6. **Data exfiltration:** Sensitive data is exfiltrated through the compromised device. 7. **Disruption:** The attacker disrupts network operations by modifying configurations or deploying malware. ### BRIDGE:BREAK context (corroborated by Forescout research, April 2026) - CVE-2025-67038 was one of 20 serial-to-IP product vulnerabilities disclosed by Forescout under the BRIDGE:BREAK project. - Vulnerabilities affect both Lantronix and Silex products. - Researchers demonstrated exploitation to manipulate sensor readings in industrial and healthcare environments — concealing dangerous conditions that would normally require human intervention. - Researchers also demonstrated causing disruption in healthcare environments via malicious firmware deployment. ### Confidence caveats - The Aviatrix-described attack scenario (steps 3–7 above) is a **potential attack scenario** described by Aviatrix in an advisory — it describes capability and plausible chain, not a confirmed observed attack. Single-sourced; verify before enforcement. - CISA states active exploitation is occurring but **no public reports describe the actual attacks** — the target sector (industrial, healthcare, or other OT) is unconfirmed. - No named threat actor is identified in any source. No MITRE ATT&CK group profile is available. Attribution is **unconfirmed**. - Lantronix has not responded to SecurityWeek's request for comment regarding in-the-wild exploitation. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Asset discovery:** Identify all Lantronix EDS5000 Series devices in the estate. Query asset management, Nmap scans, and network discovery data for Lantronix MAC OUIs and default service banners. - **Network isolation:** Immediately isolate all Lantronix EDS5000 devices from internet exposure. Enforce network segmentation so serial-to-IP converters are reachable only from dedicated management VLANs — not from the internet or general corporate networks. - **Block at perimeter:** If devices cannot be immediately isolated, apply firewall rules to block all inbound traffic to known Lantronix EDS5000 IP addresses from external sources. Restrict access to authorised management hosts only. - **EDR/NIDS monitoring:** Deploy detection rules (see §6) to monitor for command injection patterns targeting Lantronix device interfaces and anomalous outbound connections from EDS5000 IP addresses. ### P2 — Within 72 hours - **Patch application:** Apply the vendor-provided fix from Lantronix for CVE-2025-67038\. CISA has directed federal agencies to remediate by 2026-06-26; EMEA financial services should align to this timeline. - **Access hardening:** If patching is delayed, restrict management access to EDS5000 devices to a bastion host or jump box with MFA and session recording. Disable any unnecessary services on the device. - **Configuration audit:** Review and document all serial-to-IP converter configurations. Ensure default credentials are changed and management interfaces are not exposed on any interface reachable from untrusted networks. ### P3 — Within 7 days - **Full OT asset inventory:** Conduct a comprehensive inventory of all serial-to-IP converters (Lantronix and Silex) in the estate, cross-referencing against the full BRIDGE:BREAK advisory (20 vulnerabilities across both vendors). - **Architecture review:** Assess whether serial-to-IP converters are architecturally necessary on the network or can be replaced with modern, segmented alternatives. Evaluate whether OT management networks require internet routability at all. - **Third-party risk review:** Under DORA Art. 28, verify contractual provisions with Lantronix ensure timely vulnerability disclosure and patch delivery. Confirm the vendor's security advisory channel is monitored. ## 5\. Indicators of compromise No indicators of compromise (IPs, domains, hashes, filenames, or specific payloads) are available in the source material. The sources describe the vulnerability mechanism and a potential attack scenario but do not provide specific IOCs from observed attacks. **Confidence note:** CISA confirms active exploitation but no public IOCs have been released. Any IOC development should await vendor or CISA threat intelligence sharing. ## 6\. Detection The sources provide usable technical artefacts for detection: the specific vulnerability mechanism (OS command injection via a username parameter on Lantronix EDS5000), the product name, and the behavioural indicators from the Aviatrix advisory (C2 establishment, lateral movement, configuration modification). ```yara rule Lantronix_EDS5000_CVE_2025_67038_Exploit_Attempt { meta: author = "Adverse Trace" date = "2026-06-25" reference = "https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/" description = "Detects exploitation attempts against Lantronix EDS5000 CVE-2025-67038 — OS command injection via username parameter" strings: $eds5000_banner = /Lantronix EDS5000/i $username_param = /username=/i $cmd_injection1 = /username=.*;.*\x00/i $cmd_injection2 = /username=.*\|.*sh/i $cmd_injection3 = /username=.*\$\(/i $cmd_injection4 = /username=.*`/i $cmd_injection5 = /username=.*&&/i condition: $eds5000_banner or ($username_param and 2 of $cmd_injection*) } ``` ```yaml title: Detect Anomalous Outbound Connection from Lantronix EDS5000 Device id: 0c1a2b3c-4d5e-6f70-8190-a1b2c3d4e5f6 status: experimental description: Detects outbound network connections from Lantronix EDS5000 serial-to-IP devices that may indicate C2 establishment following CVE-2025-67038 exploitation references: - https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/ - https://thehackernews.com/2026/06/cisa-warns-critical-lantronix-eds5000.html author: Adverse Trace date: 2026/06/25 logsource: product: firewall product: ids/ips detection: selection: src_ip|cidr: - "%lantronix_eds5000_asset_list%" connection_initiated: true filter_legitimate_management: dst_ip: - "%authorised_management_hosts%" condition: selection and not filter_legitimate_management falsepositives: - Legitimate management traffic to authorised hosts - Firmware update checks from the device level: high ``` ```yaml title: Detect OS Command Injection in Lantronix EDS5000 Username Parameter id: 1d2b3c4d-5e6f-7081-920a-b3c4d5e6f7a8 status: experimental description: Detects OS command injection patterns in requests targeting the username parameter of Lantronix EDS5000 devices (CVE-2025-67038) references: - https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/ author: Adverse Trace date: 2026/06/25 logsource: product: web_proxy product: ids/ips product: reverse_proxy detection: selection: http.request.uri|contains: - "username=" http.request.uri|re: - "username=.*;.*" - "username=.*\\|.*" - "username=.*\\$\\(.*" - "username=.*`.*" - "username=.*&&.*" condition: selection falsepositives: - Legitimate usernames containing special characters (unlikely in OT management interfaces) level: critical ``` ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2025-67038](https://nvd.nist.gov/vuln/detail/CVE-2025-67038?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-06-23 | 1% | An issue was discovered in Lantronix EDS5000 2.1.0.0R3\. The HTTP RPC module executes a shell command to write logs when user's… | ## 7\. Sources - SecurityWeek — *Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning* — https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/ — 2026-06-25 - The Hacker News — *CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited* — https://thehackernews.com/2026/06/cisa-warns-critical-lantronix-eds5000.html — 2026-06-24 ## 8\. Adverse Trace position **Severity assessment:** CVE-2025-67038 is CVSS 9.8 CRITICAL, CISA KEV-listed with confirmed active exploitation, and requires no authentication — this is a top-tier OT vulnerability. The EPSS score of 1% is notably low and inconsistent with CISA's confirmed exploitation finding; we assess the CISA KEV listing as the authoritative exploitation signal and disregard the EPSS score for prioritisation purposes. The discrepancy is noted but does not alter our assessment. **Client-impact assessment:** EMEA financial services with data-centre OT dependencies (HVAC, UPS, building management systems) that incorporate Lantronix EDS5000 serial-to-IP converters face immediate risk of unauthenticated root-level device compromise. The attack chain described by Aviatrix — while a potential scenario rather than a confirmed observed attack — is technically credible and aligns with standard post-exp exploitation patterns for embedded Linux OT devices. The absence of public IOCs and the lack of a named threat actor mean we cannot currently attribute this to any specific campaign. Clients should treat this as a high-priority containment action: identify, isolate, and patch. We will monitor for IOC releases from CISA, Lantronix, or Forescout and issue a follow-up + update if specific attack indicators emerge. --- [Read the original source →](https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*