Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning
Lantronix EDS5000 serial-to-IP converter flaw CVE-2025-67038 exploited in active OT attacks.
A critical vulnerability (CVE-2025-67038) in Lantronix EDS5000 serial-to-IP device servers is being actively exploited in the wild, enabling unauthenticated attackers to execute arbitrary OS commands with root privileges. The flaw was disclosed in April as part of the BRIDGE:BREAK research project affecting 20 serial-to-IP product vulnerabilities. CISA added it to its Known Exploited Vulnerabilities catalog on June 23, directing federal agencies to patch by June 26, with potential lateral movement and data exfiltration risks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Lantronix?
Get an email when a new story names Lantronix, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical unauthenticated remote code execution vulnerability in Lantronix EDS5000 serial-to-IP converters (CVE-2025-67038) is being actively exploited, granting attackers root-level OS command execution without any credentials. The flaw was publicly disclosed in April 2025 as part of the BRIDGE:BREAK research initiative, yet organizations failed to patch within the disclosure window before active exploitation began. Serial-to-IP converters are particularly dangerous targets because they bridge legacy OT/serial environments to IP networks, meaning a compromise can enable lateral movement into otherwise air-gapped industrial systems. CISA's tight 3-day patching deadline for federal agencies underscores the severity — a window that many organizations struggle to meet without mature vulnerability management programs. This incident highlights how OT-adjacent network devices are increasingly targeted precisely because they are overlooked in standard patch cycles.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2025-67038