CVE-2025-67038 Lantronix EDS5000 Code Injection
Attackers can inject OS commands via the username field during failed authentication, executing arbitrary code with root privileges on Lantronix devices.
- Exploited in the wild
- Since 23 Jun 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-67038?
CVE-2025-67038 is a critical command injection vulnerability in Lantronix E210 series, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
Weakness: CWE-78
Which versions are affected by CVE-2025-67038?
It affects 33 products.
Products include Lantronix E213f102s Firmware, Lantronix E214f002s Firmware, Lantronix E214f00cs Firmware, Lantronix E214g000s Firmware, Lantronix E214g001s Firmware, Lantronix E218f004s Firmware and 27 more.
How do I fix CVE-2025-67038?
No fix has been published for CVE-2025-67038 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 26 Jun 2026.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-67038 being exploited?
Yes. Attackers have exploited CVE-2025-67038 in the wild since at least 23 Jun 2026.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CVE-2025-67043, GHSA-55gq-23mv-cw8r.