noindex and left out of the sitemap until more data is confirmed.CVE-2025-67038 is an OS command injection in the failed-login logging of the Lantronix EDS5000 industrial device server: the HTTP RPC module concatenates the submitted username straight into a shell command used to write the log entry, so a remote attacker can inject arbitrary commands that execute with root privileges — but NVD has not yet published an NVD-confirmed (Primary) CVSS score, so this page stays pending even though the CVE is on CISA's KEV list.
Vulnerability summary
N/A
Not yet scored
20.3%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-03-11
Published
Vulnerability ID: CVE-2025-67038 · Source: CISA ICS-CERT (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Lantronix EDS5000 device server | cpe:2.3:o:lantronix:eds5008_firmware:*:*:*:*:*:*:*:* | Firmware before 2.2.0.0R1 on the EDS5008/EDS5016/EDS5032 models (per NVD CPE data); fixed in 2.2.0.0R1 or later |
What this means
CVE-2025-67038 is an OS command injection (CWE-78/CWE-94) in the Lantronix EDS5000, an industrial serial-to-Ethernet device server used to network legacy serial equipment. Per NVD's description: "the HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges" (NVD).
NVD lists only a Secondary CVSS submission from CISA's own ICS-CERT team (source [email protected]): CVSS v3.1 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 9.3 (CRITICAL) (NVD) — NVD's own vulnerability status is "Analyzed" but no NVD Primary CVSS metric has been published for this CVE, so per our indexing policy the score above is labelled not NVD-confirmed and this page stays noindex with cvss_score left null.
The companion CISA ICS advisory (ICSA-26-069-02) covers eight related CVEs across the EDS5000, EDS3000PS, G520, X300, E210 and E220 product lines, all stemming from unsanitized input reaching shell commands or TFTP/SSH client parameters, and states that "successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute code with root-level privileges." It lists fixed firmware for each line (EDS5000: 2.2.0.0R1 or later) and, as of the advisory's own publication, states "no known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time" (CISA ICS Advisory ICSA-26-069-02).
Despite that advisory text, CISA separately added CVE-2025-67038 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-06-23, with a required-action due date of 2026-06-26 (catalog version 2026.10.28, confirmed live this run); KEV additions require CISA to have evidence of active exploitation, so the two CISA-sourced documents should be read together as: the ICS advisory describes the disclosed flaw and patch, while the later KEV addition reflects exploitation activity CISA observed after that advisory's publication. The KEV entry lists known ransomware-campaign use as "Unknown" (CISA KEV catalog).
As of 2026-10-28, FIRST scores the probability of exploitation at 0.20286 (97.464th percentile) — notably high for a device that requires network access to its management interface, consistent with a scanning/exploitation signal against exposed EDS5000 units rather than a merely theoretical bug (FIRST EPSS). Until NVD publishes a Primary score, treat the 9.8/9.3 figures as CISA's own assessment rather than NVD-confirmed; operators running EDS5000 2.1.0.0R3 or earlier should upgrade to 2.2.0.0R1 or later and should not expose the device's management HTTP interface directly to untrusted networks in the meantime.
Evidence
- The EDS5000 HTTP RPC module concatenates the submitted username unsanitized into a shell command used to log failed authentication, allowing arbitrary OS command injection executed with root privileges. — NVD
- NVD lists only a Secondary CVSS submission from CISA ICS-CERT (v3.1 9.8 / v4.0 9.3); no NVD Primary CVSS has been published as of this run. — NVD
- Companion ICS advisory covers 8 related CVEs across the EDS5000/EDS3000PS/G520/X300/E210/E220 lines; fixed firmware for EDS5000 is 2.2.0.0R1 or later; at the advisory's own publication, no known public exploitation had been reported to CISA. — CISA ICS Advisory ICSA-26-069-02
- Added to the CISA KEV catalog on 2026-06-23, due date 2026-06-26 (catalog version 2026.10.28); known ransomware-campaign use listed as Unknown. — CISA KEV catalog
- EPSS score is 0.20286 (97.464th percentile) as of 2026-10-28. — FIRST EPSS
