Key Takeaways
- CISA issued an urgent alert for Federal Civilian Executive Branch (FCEB) agencies to patch a critical code‑injection flaw in Lantronix EDS5000 Series devices by June 26, 2026.
- The vulnerability (CVE‑2025-67038, CVSS 9.8) allows unauthenticated attackers to inject arbitrary OS commands via the username field, executing them with root privileges.
- The flaw was disclosed by Forescout Research Vedere Labs in April 2026 as part of the BRIDGE:BREAK group affecting serial‑to‑IP converters from Lantronix and Silex.
- Concurrently, CISA confirmed active exploitation of three maximum‑severity vulnerabilities in Ubiquiti UniFi OS (CVE‑2026-34908, CVE‑2026-34909, CVE‑2026-34910).
- Bishop Fox demonstrated a proof‑of‑concept that chains the three UniFi flaws to obtain a reverse shell with full root access in a single request.
- Patches for the UniFi OS issues were released by Ubiquiti the previous month; immediate application is strongly advised.
- Successful compromise of UniFi OS devices can enable lateral movement and broader network compromise, threatening confidentiality, integrity, and availability.
- Organizations should prioritize patching, monitor for anomalous authentication attempts, and enforce network segmentation to mitigate risk.
Overview of CISA Warning on Lantronix EDS5000 Series
On Tuesday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released an advisory urging Federal Civilian Executive Branch (FCEB) agencies to apply fixes for a critical security flaw impacting Lantronix EDS5000 Series devices. The advisory set a deadline of June 26, 2026, for remediation, reflecting the severity and active exploitation of the vulnerability. CISA’s notice highlighted that the flaw could be leveraged to gain elevated control over affected hardware, posing a significant risk to federal networks that rely on these serial‑to‑IP converters for industrial and operational technology environments. The agency emphasized the importance of timely patch management as part of a broader strategy to safeguard critical infrastructure against emerging threats.
Technical Details of the Lantronix Vulnerability (CVE‑2025-67038)
The vulnerability identified as CVE‑2025-67038 carries a CVSS score of 9.8, indicating a critical level of risk. According to the description published on CVE.org, the HTTP RPC module within the EDS5000 firmware executes a shell command to write logs when a user’s authentication attempt fails. The username supplied during authentication is directly concatenated with the command without any sanitization or validation. This oversight allows an attacker to inject arbitrary operating system commands into the username parameter, which are then executed with root privileges. Because the injection occurs before authentication, no valid credentials are required, making the flaw especially dangerous for internet‑facing or inadequately segmented devices.
Disclosure by Forescout Research Vedere Labs and the BRIDGE:BREAK Set
The flaw was first disclosed by Forescout Research Vedere Labs in April 2026 as part of a broader cluster of vulnerabilities collectively dubbed BRIDGE:BREAK. This group encompasses multiple security weaknesses affecting serial‑to‑IP converters from both Lantronix and Silex manufacturers. While the advisory confirmed that the Lantronix EDS5000 Series is actively being exploited, it did not provide specifics on the exploitation methods, malware payloads, or threat actors involved. The lack of detailed technical indicators suggests that attackers may be employing custom or obfuscated techniques, underscoring the need for organizations to apply vendor patches promptly and monitor for anomalous behavior on affected devices.
CISA Confirmation of Active Exploitation in Ubiquiti UniFi OS
In the same advisory, CISA confirmed that three maximum‑severity security defects in Ubiquiti UniFi OS are also under active exploitation. The disclosure followed a report from Defused Cyber, which observed in‑the‑wild abuse of a remote code execution chain comprising CVE‑2026-34908, CVE‑2026-34909, and CVE‑2026-34910 to deploy commodity malware. The timely detection by Defused Cyber highlights the growing sophistication of threat actors targeting widely deployed networking equipment. CISA’s confirmation serves as a call to action for all organizations utilizing UniFi OS‑based access points, switches, and gateways to prioritize patching and review their exposure to these flaws.
Description of the Three Ubiquiti UniFi OS Vulnerabilities
- CVE‑2026-34908 is an improper input validation vulnerability that enables command injection. An attacker with network access can craft malicious input that the system interprets as a shell command, allowing arbitrary code execution.
- CVE‑2026-34909 is a path traversal flaw that permits a malicious actor to read or write files outside the intended directory. By manipulating file paths, an attacker could access sensitive configuration files, credentials, or logs, and potentially alter them to gain unauthorized account access.
- CVE‑2026-34910 represents an improper access control vulnerability. It allows a network‑adjacent user to make unauthorized changes to system settings, such as modifying firewall rules, user privileges, or firmware configurations, without proper authorization.
Together, these defects provide a potent foothold for attackers to compromise UniFi OS devices, exfiltrate data, and maintain persistence within a network.
Bishop Fox Proof‑of‑Concept and Available Patches
Earlier this month, Bishop Fox published a proof‑of‑concept (PoC) that demonstrates how the three UniFi OS vulnerabilities can be chained in a single request to achieve a reverse shell with full root privileges. The PoC exploits the command injection (CVE‑2026-34908) to execute a payload, leverages the path traversal (CVE‑2026-34909) to locate and modify critical system files, and uses the improper access control (CVE‑2026-34910) to elevate privileges and maintain control. Ubiquiti responded by releasing patches for all three flaws in late May 2026. Administrators are strongly urged to apply these updates immediately, verify firmware versions, and, if possible, restrict administrative interfaces to trusted management networks.
Impact Assessment from Belgium’s Centre for Cybersecurity
Belgium’s Centre for Cybersecurity warned that the UniFi OS vulnerabilities could allow remote attackers to make unauthorized system changes, access sensitive files, disclose information, or execute arbitrary commands on vulnerable devices. The agency noted that the combined impact on confidentiality, integrity, and availability is high. Because UniFi OS devices often serve as central components in enterprise wireless networks—managing multiple access points, controllers, and client traffic—a successful compromise could enable lateral movement across the network, facilitating broader infiltration, data theft, or the deployment of ransomware. The advisory stressed that organizations should treat these devices as critical assets and implement layered defenses, including network segmentation, intrusion detection, and strict least‑privilege access controls.
Recommendations and Mitigation Strategies
To mitigate the risks posed by both the Lantronix EDS5000 and Ubiquiti UniFi OS vulnerabilities, organizations should adopt a multi‑pronged approach. First, apply the vendor‑provided patches for CVE‑2025-67038 on Lantronix devices and the UniFi OS patches for CVE‑2026-34908/34909/34910 without delay, adhering to the CISA deadline of June 26, 2026, where applicable. Second, enforce network segmentation to isolate critical infrastructure devices from general user traffic, limiting the blast radius of any potential compromise. Third, implement robust authentication mechanisms, such as multi‑factor authentication, and monitor logs for abnormal authentication failures or unexpected command executions, which could indicate exploitation attempts. Fourth, deploy intrusion detection/prevention systems (IDS/IPS) tuned to detect known command‑injection and path‑traversal patterns. Finally, conduct regular vulnerability assessments and penetration testing on network‑edge equipment to ensure that residual risks are identified and addressed promptly. By combining timely patching with vigilant monitoring and architectural controls, organizations can significantly reduce the likelihood of successful exploitation and protect their critical assets from these actively exploited threats.