"The HTTP RPC module executes a shell command to write logs when the user's authentication fails," according to the vulnerability's description on CVE.org.
CVE-2025-67038: a critical code-injection flaw in Lantronix EDS5000
CVE-2025-67038 (CVSS score: 9.8) is a code-injection vulnerability that affects Lantronix EDS5000 Series devices. The flaw stems from how the device's HTTP RPC module handles failed authentication: the username is concatenated directly into a shell command with no input sanitization. As CVE.org describes it, "The username is directly concatenated with the command without any sanitization. This allows attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges." That combination of unauthenticated input and root execution is why CISA classifies the issue as critical.
CISA advisory and the June 26, 2026 remediation deadline for FCEB agencies
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned that CVE-2025-67038 is being actively exploited and urged Federal Civilian Executive Branch (FCEB) agencies to apply available fixes by June 26, 2026. The advisory explicitly states that the vulnerability is under active exploitation, but notes there are currently no details on how the vulnerability is being exploited, or who is making the effort.
BRIDGE:BREAK disclosure and the broader serial-to‑IP converter context
Forescout Research Vedere Labs disclosed the vulnerability in April 2026 as part of a broader set of flaws codenamed BRIDGE:BREAK. That research identified issues affecting serial-to-IP converters from Lantronix and Silex. The inclusion of CVE-2025-67038 in BRIDGE:BREAK ties this critical Lantronix flaw to a set of product classes—serial-to-IP converters—that bridge operational-technology and information-technology networks, increasing the potential impact of successful exploitation.
Concurrent active exploitation of Ubiquiti UniFi OS and technical chain details
CISA's advisory on active exploitation arrived days after Defused Cyber reported in-the-wild abuse of a three‑CVE chain in Ubiquiti UniFi OS. Those defects are:
- CVE-2026-34908 — an improper input validation vulnerability that could allow a malicious actor with access to the network to conduct command injection.
- CVE-2026-34909 — a path traversal vulnerability that could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.
- CVE-2026-34910 — an improper access control vulnerability that could allow a malicious actor with access to the network to make unauthorized changes to the system.
Bishop Fox published a proof-of-concept earlier this month demonstrating a single-request chain that leverages those three shortcomings to obtain a reverse shell with full root privileges. Patches for the Ubiquiti flaws were released by Ubiquiti late last month. Belgium's Centre for Cybersecurity warned that "The vulnerabilities could allow remote attackers to make unauthorized system changes, access sensitive files, disclose information, or execute arbitrary commands on vulnerable systems, highly impacting the confidentiality, integrity, and availability of targeted devices," and added that "Given that UniFi OS devices are often centrally integrated into networks, successful compromise could enable lateral movement and broader network compromise."
What this means for FCEB agencies, security teams, and network operators
- FCEB agencies: CISA has set a June 26, 2026 deadline to apply the fixes for CVE-2025-67038, making immediate patch validation and deployment the operational priority cited in the advisory.
- Security teams and network operators: The combination of active exploitation, root‑privilege command execution, and central integration of devices like UniFi OS means teams must prioritize inventorying affected Lantronix and UniFi OS devices, apply vendor fixes, and monitor for signs of lateral movement.
- Affected enterprises and procurement leaders: Because BRIDGE:BREAK targets serial-to-IP converters used to bridge networks, purchasers and asset owners should re-evaluate devices that provide out-of-band or serial bridging functions and confirm patches or mitigations are in place.
Two threads run through the advisory: multiple high-severity vulnerabilities are being exploited in the wild, and at least one enables arbitrary commands as root. CISA's deadline for FCEB agencies, the public disclosure timeline from Forescout Research Vedere Labs, and Bishop Fox's proof-of-concept for the UniFi chain all point to a narrow window for defenders to act. There are currently no details on the actors or the exploitation techniques in the wild for the Lantronix flaw, leaving agencies and operators to assume active exploitation until forensic evidence indicates otherwise.
