#lantronix — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #lantronix, aggregated by home.social.
-
If you have any LuCI-based #Lantronix Serial-to-Ethernet device exposed on the internet, then you may want to kickoff your incident response plan.
My suspicion is that the unauthenticated Remote Code Execution vulnerability CVE-2025-67038 affects a lot more device types than just the EDS5000 that is mentioned in the advisory.
The vulnerable code path is in a modified OpenWRT LuCI RPC module that puts a user-controlled variable inside a Lua `os.execute` call. This vulnerable code is contained in a lot of device firmware versions released in or after 2023. Unfortunately, I do not have the devices to actually test exploitability. My analysis is based purely on patch diffing and grepping publicly released firmware versions. The incomplete list of device types that contain the vulnerable code: EDS5000, G520, G526, G526RP, G527, G528, X300, X300-WiFi, X303, X304. I also suspect E210 is on the incomplete list of vulnerable devices.
Back in April this vulnerability was published by Forescout as part of their BRIDGE:BREAK report on Serial-to-Ethernet adapters. Two days ago this vulnerability was added to the CISA KEV Catalog. Yesterday Forescout published a blogpost they first observed exploitation attempts on the 5th of April 2026. Attacks are attributed to a new cluster Chaya_006. It is unclear if Lantronix took the effort to check if any of their other devices are vulnerable given that they contain the same RPC module.
You want to look for POST requests to `/cgi-bin/luci/rpc/auth` in your logs. Forescout has a number 3 octet IP addresses as Indicator of Compromise here: https://www.forescout.com/blog/analyzing-active-exploitation-of-lantronix-and-openwrt-luci/ . The running theory is that these are supposed to be /24 CIDR ranges.
-
If you have any LuCI-based #Lantronix Serial-to-Ethernet device exposed on the internet, then you may want to kickoff your incident response plan.
My suspicion is that the unauthenticated Remote Code Execution vulnerability CVE-2025-67038 affects a lot more device types than just the EDS5000 that is mentioned in the advisory.
The vulnerable code path is in a modified OpenWRT LuCI RPC module that puts a user-controlled variable inside a Lua `os.execute` call. This vulnerable code is contained in a lot of device firmware versions released in or after 2023. Unfortunately, I do not have the devices to actually test exploitability. My analysis is based purely on patch diffing and grepping publicly released firmware versions. The incomplete list of device types that contain the vulnerable code: EDS5000, G520, G526, G526RP, G527, G528, X300, X300-WiFi, X303, X304. I also suspect E210 is on the incomplete list of vulnerable devices.
Back in April this vulnerability was published by Forescout as part of their BRIDGE:BREAK report on Serial-to-Ethernet adapters. Two days ago this vulnerability was added to the CISA KEV Catalog. Yesterday Forescout published a blogpost they first observed exploitation attempts on the 5th of April 2026. Attacks are attributed to a new cluster Chaya_006. It is unclear if Lantronix took the effort to check if any of their other devices are vulnerable given that they contain the same RPC module.
You want to look for POST requests to `/cgi-bin/luci/rpc/auth` in your logs. Forescout has a number 3 octet IP addresses as Indicator of Compromise here: https://www.forescout.com/blog/analyzing-active-exploitation-of-lantronix-and-openwrt-luci/ . The running theory is that these are supposed to be /24 CIDR ranges.
-
Vulnerabilities Expose 20,000 Serial-to-IP Converters to Hijacking Risk
A shocking 20,000 serial-to-IP converters are at risk of being hijacked due to newly discovered vulnerabilities, putting countless systems and data in jeopardy. Cybersecurity experts at Forescout Research Vedere Labs have uncovered 22 flaws in popular models from leading manufacturers Lantronix and Silex.
#Bridgebreak #Lantronix #Silex #Serialtoip #IndustrialControlSystems
-
Lantronix Device Used in Critical Infrastructure Exposes Systems to Remote Hacking https://www.securityweek.com/lantronix-device-used-in-critical-infrastructure-exposes-systems-to-remote-hacking/ #Lantronix #ICS/OT #ICS
-
Lantronix Device Used in Critical Infrastructure Exposes Systems to Remote Hacking https://www.securityweek.com/lantronix-device-used-in-critical-infrastructure-exposes-systems-to-remote-hacking/ #Lantronix #ICS/OT #ICS
-
Lantronix Device Used in Critical Infrastructure Exposes Systems to Remote Hacking https://www.securityweek.com/lantronix-device-used-in-critical-infrastructure-exposes-systems-to-remote-hacking/ #Lantronix #ICS/OT #ICS
-
Lantronix Device Used in Critical Infrastructure Exposes Systems to Remote Hacking https://www.securityweek.com/lantronix-device-used-in-critical-infrastructure-exposes-systems-to-remote-hacking/ #Lantronix #ICS/OT #ICS
-
Multiple vulnerabilities in Lantronix EDS-MD IoT gateway for medical devices: https://www.pentagrid.ch/en/blog/multiple-vulnerabilties-in-lantronix-eds-md-iot-gateway/ #itsecurity #infosec #pentesting #lantronix #iot #medical