CVE Tools
Track your stack

CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited

The Hacker NewsBy The Hacker News

Reported exploitedEDS5000

Our summary

The U.S. CISA has issued an urgent warning that a critical vulnerability in Lantronix EDS5000 Series devices is being actively exploited in the wild. The issue, CVE-2025-67038 (CVSS 9.8), is a code injection weakness that can allow attackers to execute arbitrary commands with elevated/root privileges via the HTTP RPC logging behavior. CISA urged Federal Civilian Executive Branch agencies to apply the available fixes by June 26, 2026, highlighting the risk of full device compromise and potential broader network impact.

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. BleepingComputerCISA warns of max severity Ubiquiti flaws exploited in attacksCVE-2025-67038, CVE-2026-34908 +2
  2. SecurityWeekCritical Ubiquiti Vulnerabilities in Attackers’ CrosshairsCVE-2025-67038, CVE-2026-34908 +2
  3. Daily CyberSecurity (securityonline.info)CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV CatalogCVE-2025-67038, CVE-2026-34908 +2
  4. BleepingComputerChinese hackers exploit WordPress, Zyxel flaws to steal govt dataCVE-2026-34908, CVE-2026-34909 +1
  5. The Hacker NewsUbiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OSCVE-2026-34908, CVE-2026-34909 +1
  6. Check Point Research29th June – Threat Intelligence ReportCVE-2026-34908, CVE-2026-34909 +1
  7. The Hacker News⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and MoreCVE-2026-34908, CVE-2026-34909 +1
  8. BleepingComputerCritical UniFi OS bug lets hackers gain root without authenticationCVE-2026-34908, CVE-2026-34909 +1
  9. Bishop FoxPopping Root on UniFi OS Server: Unauthenticated RCE Chain Detection & AnalysisCVE-2026-34908, CVE-2026-34909 +1
  10. The Hacker News⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and MoreCVE-2026-34908, CVE-2026-34909

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store