Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning

1. Executive summary

CISA added CVE-2025-67038 (CVSS 9.8 CRITICAL, CWE-94 Code Injection) to its Known Exploited Vulnerabilities (KEV) catalog on 2026-06-23, confirming active in-the-wild exploitation of Lantronix EDS5000 Series serial-to-IP device servers. The flaw permits an unauthenticated attacker to inject arbitrary OS commands via a username parameter, executing them with root privileges. The vulnerability was originally disclosed in April 2026 by Forescout as part of the BRIDGE:BREAK research project, which identified 20 serial-to-IP vulnerabilities across Lantronix and Silex products. EMEA financial services with OT dependencies (data-centre HVAC, UPS, building management systems) should treat internet-exposed serial-to-IP converters as immediate compromise candidates.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability: CVE-2025-67038

• CVSS: 9.8 CRITICAL (authoritative — VERIFIED REFERENCE DATA)
• CWE: CWE-94 (Code Injection) — authoritative from verified data
• CISA KEV: Added 2026-06-23; federal agency remediation due 2026-06-26
• EPSS: 1% — indicating low exploitation probability scoring, though CISA has confirmed active exploitation notwithstanding this metric
• Affected product: Lantronix EDS5000 Series serial-to-IP device servers
• Authentication: None required — unauthenticated attacker
• Injection vector: OS command injection via a username parameter
• Execution context: Root privileges

Attack chain (confirmed steps from source material)

1. Reconnaissance: Attacker identifies an internet-exposed Lantronix EDS5000 device. ZoomEye indicates thousands of internet-exposed Lantronix systems exist, though this aggregate includes all Lantronix product lines and the count of specifically vulnerable EDS5000 units is unclear.
2. Initial exploitation: Unauthenticated attacker sends a request to the EDS5000 device, injecting arbitrary OS commands into the username parameter. Commands execute with root privileges due to the device's service context.
3. Foothold establishment: The compromised device becomes a network foothold. The attacker gains full control of the device.
4. Command and control: The attacker establishes a C2 channel to remotely manage the compromised device and issue further commands.
5. Lateral movement: The attacker moves laterally from the compromised device to target other connected systems within the network.
6. Data exfiltration: Sensitive data is exfiltrated through the compromised device.
7. Disruption: The attacker disrupts network operations by modifying configurations or deploying malware.

BRIDGE:BREAK context (corroborated by Forescout research, April 2026)

• CVE-2025-67038 was one of 20 serial-to-IP product vulnerabilities disclosed by Forescout under the BRIDGE:BREAK project.
• Vulnerabilities affect both Lantronix and Silex products.
• Researchers demonstrated exploitation to manipulate sensor readings in industrial and healthcare environments — concealing dangerous conditions that would normally require human intervention.
• Researchers also demonstrated causing disruption in healthcare environments via malicious firmware deployment.

Confidence caveats

• The Aviatrix-described attack scenario (steps 3–7 above) is a potential attack scenario described by Aviatrix in an advisory — it describes capability and plausible chain, not a confirmed observed attack. Single-sourced; verify before enforcement.
• CISA states active exploitation is occurring but no public reports describe the actual attacks — the target sector (industrial, healthcare, or other OT) is unconfirmed.
• No named threat actor is identified in any source. No MITRE ATT&CK group profile is available. Attribution is unconfirmed.
• Lantronix has not responded to SecurityWeek's request for comment regarding in-the-wild exploitation.

4. Mitigation & containment

P1 — Within 24 hours

• Asset discovery: Identify all Lantronix EDS5000 Series devices in the estate. Query asset management, Nmap scans, and network discovery data for Lantronix MAC OUIs and default service banners.
• Network isolation: Immediately isolate all Lantronix EDS5000 devices from internet exposure. Enforce network segmentation so serial-to-IP converters are reachable only from dedicated management VLANs — not from the internet or general corporate networks.
• Block at perimeter: If devices cannot be immediately isolated, apply firewall rules to block all inbound traffic to known Lantronix EDS5000 IP addresses from external sources. Restrict access to authorised management hosts only.
• EDR/NIDS monitoring: Deploy detection rules (see §6) to monitor for command injection patterns targeting Lantronix device interfaces and anomalous outbound connections from EDS5000 IP addresses.

P2 — Within 72 hours

• Patch application: Apply the vendor-provided fix from Lantronix for CVE-2025-67038. CISA has directed federal agencies to remediate by 2026-06-26; EMEA financial services should align to this timeline.
• Access hardening: If patching is delayed, restrict management access to EDS5000 devices to a bastion host or jump box with MFA and session recording. Disable any unnecessary services on the device.
• Configuration audit: Review and document all serial-to-IP converter configurations. Ensure default credentials are changed and management interfaces are not exposed on any interface reachable from untrusted networks.

P3 — Within 7 days

• Full OT asset inventory: Conduct a comprehensive inventory of all serial-to-IP converters (Lantronix and Silex) in the estate, cross-referencing against the full BRIDGE:BREAK advisory (20 vulnerabilities across both vendors).
• Architecture review: Assess whether serial-to-IP converters are architecturally necessary on the network or can be replaced with modern, segmented alternatives. Evaluate whether OT management networks require internet routability at all.
• Third-party risk review: Under DORA Art. 28, verify contractual provisions with Lantronix ensure timely vulnerability disclosure and patch delivery. Confirm the vendor's security advisory channel is monitored.

5. Indicators of compromise

No indicators of compromise (IPs, domains, hashes, filenames, or specific payloads) are available in the source material. The sources describe the vulnerability mechanism and a potential attack scenario but do not provide specific IOCs from observed attacks.

Confidence note: CISA confirms active exploitation but no public IOCs have been released. Any IOC development should await vendor or CISA threat intelligence sharing.

6. Detection

The sources provide usable technical artefacts for detection: the specific vulnerability mechanism (OS command injection via a username parameter on Lantronix EDS5000), the product name, and the behavioural indicators from the Aviatrix advisory (C2 establishment, lateral movement, configuration modification).

rule Lantronix_EDS5000_CVE_2025_67038_Exploit_Attempt {
    meta:
        author = "Adverse Trace"
        date = "2026-06-25"
        reference = "https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/"
        description = "Detects exploitation attempts against Lantronix EDS5000 CVE-2025-67038 — OS command injection via username parameter"
    strings:
        $eds5000_banner = /Lantronix EDS5000/i
        $username_param = /username=/i
        $cmd_injection1 = /username=.*;.*\x00/i
        $cmd_injection2 = /username=.*\|.*sh/i
        $cmd_injection3 = /username=.*\$\(/i
        $cmd_injection4 = /username=.*`/i
        $cmd_injection5 = /username=.*&&/i
    condition:
        $eds5000_banner or ($username_param and 2 of $cmd_injection*)
}

title: Detect Anomalous Outbound Connection from Lantronix EDS5000 Device
id: 0c1a2b3c-4d5e-6f70-8190-a1b2c3d4e5f6
status: experimental
description: Detects outbound network connections from Lantronix EDS5000 serial-to-IP devices that may indicate C2 establishment following CVE-2025-67038 exploitation
references:

  - https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/
  - https://thehackernews.com/2026/06/cisa-warns-critical-lantronix-eds5000.html
author: Adverse Trace
date: 2026/06/25
logsource:
    product: firewall
    product: ids/ips
detection:
    selection:
        src_ip|cidr:

            - "%lantronix_eds5000_asset_list%"
        connection_initiated: true
    filter_legitimate_management:
        dst_ip:

            - "%authorised_management_hosts%"
    condition: selection and not filter_legitimate_management
falsepositives:

    - Legitimate management traffic to authorised hosts
    - Firmware update checks from the device
level: high

title: Detect OS Command Injection in Lantronix EDS5000 Username Parameter
id: 1d2b3c4d-5e6f-7081-920a-b3c4d5e6f7a8
status: experimental
description: Detects OS command injection patterns in requests targeting the username parameter of Lantronix EDS5000 devices (CVE-2025-67038)
references:

  - https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/
author: Adverse Trace
date: 2026/06/25
logsource:
    product: web_proxy
    product: ids/ips
    product: reverse_proxy
detection:
    selection:
        http.request.uri|contains:

            - "username="
        http.request.uri|re:

            - "username=.*;.*"
            - "username=.*\\|.*"
            - "username=.*\\$\\(.*"
            - "username=.*`.*"
            - "username=.*&&.*"
    condition: selection
falsepositives:

    - Legitimate usernames containing special characters (unlikely in OT management interfaces)
level: critical

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• SecurityWeek — Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning — https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/ — 2026-06-25
• The Hacker News — CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited — https://thehackernews.com/2026/06/cisa-warns-critical-lantronix-eds5000.html — 2026-06-24

8. Adverse Trace position

Severity assessment: CVE-2025-67038 is CVSS 9.8 CRITICAL, CISA KEV-listed with confirmed active exploitation, and requires no authentication — this is a top-tier OT vulnerability. The EPSS score of 1% is notably low and inconsistent with CISA's confirmed exploitation finding; we assess the CISA KEV listing as the authoritative exploitation signal and disregard the EPSS score for prioritisation purposes. The discrepancy is noted but does not alter our assessment.

Client-impact assessment: EMEA financial services with data-centre OT dependencies (HVAC, UPS, building management systems) that incorporate Lantronix EDS5000 serial-to-IP converters face immediate risk of unauthenticated root-level device compromise. The attack chain described by Aviatrix — while a potential scenario rather than a confirmed observed attack — is technically credible and aligns with standard post-exp exploitation patterns for embedded Linux OT devices. The absence of public IOCs and the lack of a named threat actor mean we cannot currently attribute this to any specific campaign. Clients should treat this as a high-priority containment action: identify, isolate, and patch. We will monitor for IOC releases from CISA, Lantronix, or Forescout and issue a follow-up + update if specific attack indicators emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.