CISA Flags Actively Exploited Lantronix EDS5000 Vulnerability Allowing Root-Level OS Command Injection

An unauthenticated attacker can inject arbitrary OS commands via a username parameter, executing them with root privileges.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 23, requiring federal agencies to remediate by June 26.

Forescout previously disclosed 20 serial-to-IP product vulnerabilities, collectively tracked as BRIDGE:BREAK, affecting Lantronix and Silex and enabling manipulation of sensor readings or disruption via malicious firmware.

Aviatrix outlined an attack path where root code execution yields full device control, lateral movement, and a command-and-control channel for remote management.