CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited
Summary: CISA warned on Tuesday that CVE-2025-67038, a code injection flaw with a CVSS score of 9.8 in Lantronix EDS5000 Series devices, is being actively exploited, and set a June 26, 2026 patch deadline for FCEB agencies. The flaw lets attackers inject OS commands through the username parameter of failed authentication requests to the /cgi-bin/luci/rpc/auth endpoint, which execute with root privileges; Forescout reported a threat actor it calls Chaya_006 exploited it against honeypots from April 5 to June 3, 2026, possibly by reverse-engineering the February 20 patch.
Why it matters: The exploit executes as root through a login field, and Forescout's Shodan search found roughly 31,850 internet-exposed devices running OpenWRT LuCI, about 5,000 of them honeypots - a large pool of targets for anyone who reverse-engineered the fix before the flaw was public.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-67038CVE-2026-34908CVE-2026-34909CVE-2026-34910
- Related