cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

CISA Flags Active Exploitation of Lantronix EDS5000 and UniFi OS Flaws

· Original article ↗

Summary

CISA says CVE-2025-67038 is being actively exploited in Lantronix EDS5000 devices, and confirms active exploitation of three UniFi OS flaws. The issues can enable privileged command execution, root access, and lateral movement.

Key points

  • CISA warned that CVE-2025-67038, a command-injection flaw in Lantronix EDS5000 devices, is being actively exploited; it can enable arbitrary commands with elevated privileges.
  • CISA set June 26, 2026, as the deadline for Federal Civilian Executive Branch agencies to apply the Lantronix fix.
  • Forescout Research Vedere Labs disclosed CVE-2025-67038 as part of its BRIDGE:BREAK vulnerability findings.
  • The article says CISA confirmed active exploitation of three UniFi OS flaws: CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910.
  • The UniFi OS flaws involve input validation, path traversal, and access control issues; together, they can enable root access and lateral movement.
  • The article reports that Ubiquiti released patches for the UniFi OS flaws. It gives no details on who is exploiting the Lantronix flaw or how.

Article Details

Vulnerability Types
  • OS command injection
  • Improper input validation
  • Path traversal
  • Improper access control
Severity
CVE-2025-67038 has a CVSS score of 9.8; the three UniFi OS vulnerabilities are described as maximum-severity.
Exploitation Status
active
Exploit Availability
public_poc
Patch Status
available

MITRE ATT&CK

T1059.004 · Unix ShellCVE-2025-67038 allows injected OS commands to execute through a shell with root privileges; the UniFi OS proof of concept obtains a root-privileged reverse shell.

CVE

CVE-2025-67038Lantronix · E210 series; Lantronix · E220 series; +3 moreCISA warned that CVE-2025-67038 in Lantronix EDS5000 Series devices is being actively exploited, and FCEB agencies must apply the fix by June 26, 2026.CVE-2026-34908Ubiquiti Inc · EFG; Ubiquiti Inc · ENVR; +29 moreThe advisory also highlighted active exploitation of UniFi OS flaws chained as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, which can lead to root-level code execution and broader network compromise.CVE-2026-34909Ubiquiti Inc · EFG; Ubiquiti Inc · ENVR; +30 moreThe advisory also highlighted active exploitation of UniFi OS flaws chained as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, which can lead to root-level code execution and broader network compromise.CVE-2026-34910Ubiquiti Inc · EFG; Ubiquiti Inc · ENVR; +29 moreThe advisory also highlighted active exploitation of UniFi OS flaws chained as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, which can lead to root-level code execution and broader network compromise.

Vendors

LantronixCISA warned that CVE-2025-67038 in Lantronix EDS5000 Series devices is being actively exploited, and FCEB agencies must apply the fix by June 26, 2026.UbiquitiPatches for the flaws were released by Ubiquiti late last month.

Products

EDS5000 SeriesCISA warned that CVE-2025-67038 in Lantronix EDS5000 Series devices is being actively exploited, and FCEB agencies must apply the fix by June 26, 2026.Ubiquiti UniFi OSThe advisory also highlighted active exploitation of UniFi OS flaws chained as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, which can lead to root-level code execution and broader network compromise.

Related Articles