CISA Warns of Active Attacks on Critical Lantronix and Ubiquiti Device Flaws

The U.S. Cybersecurity and Infrastructure Security Agency has warned that a critical flaw in Lantronix's EDS5000-series device servers is being exploited in real-world attacks, ordering federal civilian agencies to patch it by June 26.

The detail that should focus any administrator's attention is the word "actively." CISA adds a vulnerability to its Known Exploited Vulnerabilities catalog only when it has evidence the flaw is being attacked in the real world, not merely that it could be — and it has placed four such device flaws on a three-day federal clock. The vendors have already shipped fixes. The entire risk now lives in the window between a patch being available and a patch being applied.

The vulnerability, CVE-2025-67038, scores 9.8 out of 10 on the CVSS severity scale — an unauthenticated command-injection flaw that lets an attacker run commands on the device with the highest level of privilege, without needing a password. It affects EDS5000-series serial-to-IP console servers running firmware 2.1.0.0R3, and it was disclosed in April by Forescout's Vedere Labs research arm as part of "BRIDGE:BREAK," a set of 22 vulnerabilities affecting serial-to-IP converters from Lantronix and Japan's Silex Technology. How it is currently being exploited, and by whom, hasn't been made public. Lantronix has released a fix; affected users should upgrade to EDS5000 version 2.2.0.0R1.

The warning came alongside CISA's confirmation that three maximum-severity flaws in Ubiquiti's UniFi OS are also being actively exploited. The security firm Defused reported signs that attackers were chaining the three — tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 — into a remote-code-execution attack to distribute malware, and earlier this month Bishop Fox published proof-of-concept code demonstrating that the three could be combined to gain full control of a device. Ubiquiti patched the flaws in UniFi OS Server version 5.0.8, released late last month.

Belgium's Centre for Cybersecurity warned that exploiting the flaws lets a remote attacker alter systems, access sensitive files, exfiltrate data, or run arbitrary commands, seriously threatening a device's confidentiality, integrity, and availability — and noted that because UniFi OS devices often sit at the core of networks, a compromise could open the door to lateral movement and a broader network breach.

What makes both clusters dangerous is less the devices' own data than their position in a network. A Lantronix serial-to-IP console server bridges physical equipment — industrial controllers, networking gear, other serial devices — onto the IP network, while a Ubiquiti UniFi OS appliance often sits at the center of a network, routing the traffic around it. An attacker who takes over either one gains not just that box but a foothold to move sideways into everything connected to it. That is why a flaw in a single appliance can become the opening move in a wider intrusion.

The two cases also the profile that makes security teams move fastest: both are reachable over the network without any login, and both hand the attacker the device's highest privilege level. A command-injection flaw, the class behind the Lantronix bug, is a long-understood weakness in which a program builds a system command out of user-supplied input without keeping the two cleanly separated, so input that was supposed to be harmless data ends up being run as a command. The Ubiquiti case is a chain, in which several individually serious weaknesses combine to achieve what none would alone. Both are exactly the kind of flaw CISA's catalog exists to flag.

The response is unglamorous but decisive: apply the vendor patches now. Federal civilian agencies are bound by the June 26 deadline, but the threat does not distinguish between government and private networks — exploitation is already underway, and any organization running these devices should treat the federal clock as its own. For systems that cannot be patched immediately, security researchers advise walling the device's management interface off from untrusted networks and watching logs for anomalous requests or unexpected new administrator accounts, since a compromise that has already happened will not be undone by patching alone.

What is CVE-2025-67038?

CVE-2025-67038 is a critical security vulnerability in Lantronix EDS5000-series serial-to-IP console servers running firmware 2.1.0.0R3, scoring 9.8 out of 10 on the CVSS severity scale. It is an unauthenticated command-injection flaw, meaning an attacker with network access — but no valid credentials — can run commands on the device at the highest privilege level. It was disclosed in April 2026 by Forescout's Vedere Labs as one of 22 vulnerabilities in the "BRIDGE:BREAK" research affecting Lantronix and Silex devices. Lantronix has released a fix in EDS5000 firmware version 2.2.0.0R1.

Which Ubiquiti devices are affected?

The flaws affect devices running Ubiquiti's UniFi OS, the operating system behind much of Ubiquiti's networking hardware widely used in small-business and enterprise networks. Three maximum-severity vulnerabilities — CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 — can be chained together by a network-based attacker to achieve remote code execution. Ubiquiti addressed them in UniFi OS Server version 5.0.8, released late last month. Administrators running UniFi OS devices should update to that version or later as a priority.

What is the CISA KEV catalog?

The Known Exploited Vulnerabilities (KEV) catalog is a list maintained by the U.S. Cybersecurity and Infrastructure Security Agency of security flaws that have been confirmed as actively exploited in real-world attacks. A vulnerability is added only when there is evidence of genuine exploitation, not merely theoretical risk, which makes the catalog a strong signal of urgency. Under CISA's binding operational directives, federal civilian agencies must remediate KEV-listed flaws within set deadlines — in this case, three days. While only federal agencies are legally bound, CISA recommends all organizations treat KEV entries as high-priority.

How do I address the Lantronix and Ubiquiti flaws?

The primary step is to apply the vendor patches: upgrade affected Lantronix EDS5000 devices to firmware 2.2.0.0R1, and update Ubiquiti UniFi OS devices to UniFi OS Server 5.0.8 or later. Because exploitation is already active, organizations should do this without waiting for a normal maintenance window. For devices that cannot be patched right away, security researchers recommend restricting the device's management interface to trusted networks and monitoring logs for unusual activity or unexpected new administrator accounts. Patching does not undo a compromise that already occurred, so potentially exposed devices should be reviewed for signs of intrusion.