What happened
CVE-2025-67038 is an OS command-injection vulnerability in the HTTP RPC authentication path used by several Lantronix device families [S1]. CISA's advisory says an unauthenticated attacker can place operating-system commands in a username processed after failed authentication, with resulting commands executed with root privileges [S1].
CISA rates the issue 9.8 Critical under CVSS 3.1 and maps it to CWE-78 [S1]. CISA added CVE-2025-67038 to the Known Exploited Vulnerabilities catalog on June 23, 2026, which means organizations should treat exposed affected devices as an urgent remediation priority [S3].
Affected products and versions
CISA's machine-readable advisory lists EDS5000 through 2.1.0.0R3, G520 and X300 before 2.6.0.4R6, and E210 and E220 before 3.21.0.0R1 as affected by CVE-2025-67038 [S1]. The Lantronix advisory identifies those same five product families and marks the issue fixed [S2].
For EDS5000 specifically, CISA describes the vulnerable authentication-logging behavior in version 2.1.0.0R3 [S1]. Administrators should inventory the exact model and running firmware rather than inferring patch state from a public login page or a generic product banner.
Remediation and verification
Lantronix directs EDS5000 operators to upgrade to firmware 2.2.0.0R1 or later [S2]. For the other affected families, the vendor specifies 2.6.0.4R6 or later for X300 and G520, and 3.21.0.0R1 or later for E210 and E220 [S2].
If an immediate upgrade is not possible, Lantronix recommends replacing default credentials, prohibiting weak passwords, restricting network access, placing affected devices behind a firewall, and limiting management interfaces to trusted networks [S2]. CISA separately recommends removing control-system devices from direct internet exposure and isolating them behind firewalls [S1].
After updating, verify the running firmware from the device's trusted administration or asset-management interface and confirm it meets the vendor's fixed version for that model [S2]. Review authentication, administrative, and network telemetry for unexpected activity, and follow the incident-response requirements applicable to a KEV-listed asset [S3].
Why FixVibe will not check this automatically
FixVibe will not publish an automatic CVE-2025-67038 finding because a passive web fingerprint cannot establish the exact running firmware or whether the vendor fix is installed [S2]. The affected targets are industrial and network devices, and their authoritative patch state belongs in trusted device inventory and administration surfaces rather than a public application scan [S1].
A conclusive active test would exercise an unauthenticated command-injection path that can run operating-system commands with root privileges [S1]. That crosses FixVibe's safe scanning boundary: FixVibe will not submit command-execution material, trigger callbacks, or attempt to prove root access. Operators should verify firmware directly, apply the Lantronix update, and restrict management exposure [S2].