CVE-2025-67038

This flaw is like a “type-your-name” box that the device accidentally treats as real instructions. When someone guesses or triggers a failed login, they can smuggle in commands that the device then runs with full control (root). The real-world risk is that an attacker can turn the device into a foothold for further attacks or to knock it offline.

This matters if you use Lantronix EDS5032, EDS5008, or EDS5016 firmware (Lantronix EDS5000 family) for serial-to-IP connectivity, especially if it can be contacted over the network. The vulnerability does not require a login or user action, so exposure depends mainly on whether the HTTP RPC endpoint is reachable from your network or the internet. Treat it as a risk if the device is reachable from the internet or from untrusted networks without strong network restrictions.

This is RED because attackers are already exploiting it in the wild, and CISA added it to its Known Exploited Vulnerabilities list with a near-term deadline. Since it is reachable over the network without authentication, delay directly increases the chance of a real compromise. Fix it immediately by upgrading or, if you can’t, by cutting off network access to the device while you prepare the upgrade.