CISA Adds Critical Lantronix and Ubiquiti Vulnerabilities to KEV Catalog Amid Active Exploitation

Executive Summary

On June 24, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four critical vulnerabilities affecting Lantronix and Ubiquiti networking equipment to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms that threat actors are actively exploiting these flaws in the wild. The vulnerabilities include CVE-2025-67038, a 9.8 CVSS score command injection flaw in Lantronix EDS5000 series devices, and a chain of three flaws (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) in Ubiquiti UniFi OS, which collectively achieve a 10.0 CVSS score for unauthenticated remote code execution. Given the active exploitation and the critical role these devices play in network infrastructure, CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies patch these vulnerabilities by June 26, 2026. This advisory underscores the urgent need for all organizations using these products to take immediate remedial action to prevent system compromise.

Vulnerability Details

Lantronix EDS5000 Series: CVE-2025-67038

This critical vulnerability (CVSS 9.8) is a command injection flaw within the HTTP RPC module of Lantronix EDS5000 series serial-to-IP device servers. Research from Forescout's Vedere Labs, part of their "BRIDGE:BREAK" study, revealed that the application insecurely concatenates a username into a shell command when logging failed authentication attempts. An unauthenticated, remote attacker can craft a malicious username containing shell commands. When an authentication attempt with this username fails, the server executes the injected commands with root privileges. This provides the attacker with complete control over the device.

Ubiquiti UniFi OS: CVE-2026-34908, CVE-2026-34909, CVE-2026-34910

This set of three vulnerabilities, when chained together, allows for unauthenticated remote code execution with a maximum CVSS score of 10.0. The attack chain works as follows:

1. CVE-2026-34908 (Improper Access Control): Allows an attacker to bypass authentication checks.
2. CVE-2026-34909 (Path Traversal): Enables the authenticated (or bypass-authenticated) attacker to read and write arbitrary files on the system.
3. CVE-2026-34910 (Improper Input Validation): Allows the attacker to inject malicious commands, which can be executed via the file write capability from the path traversal flaw.

Together, these flaws enable a remote attacker to gain a reverse shell with root privileges, effectively taking full control of the UniFi OS device.

Technical Analysis

Threat actors are leveraging these vulnerabilities to establish initial access and persistence within target networks. The attack patterns align with common tactics for compromising edge devices.

Lantronix Attack Vector

The exploitation of CVE-2025-67038 is a classic example of T1190 - Exploit Public-Facing Application. The attacker sends a crafted HTTP request to the device's web interface, targeting the login function. The username field is the injection point. For example, a username like ';/bin/sh -c "<malicious_command>";' would be executed by the system's shell. This allows for direct T1059.004 - Command and Scripting Interpreter: Unix Shell execution.

Ubiquiti Attack Vector

The Ubiquiti exploit chain is more complex, demonstrating a multi-stage compromise. After bypassing authentication, attackers use the path traversal flaw to write a script or webshell to a predictable location on the device. They then use the input validation flaw to trigger the execution of this script. Reports of attackers creating rogue administrator accounts suggest a post-exploitation objective of T1078.001 - Valid Accounts: Default Accounts or creating new local accounts for persistence.

Impact Assessment

The impact of compromising these devices is severe. Lantronix EDS5000 servers are often used as communication bridges in Industrial Control Systems (ICS) and Operational Technology (OT) environments. A breach could lead to disruption of physical processes, data exfiltration from sensitive industrial networks, or serve as a pivot point for wider attacks on corporate infrastructure. The potential for physical disruption elevates the risk beyond typical IT security incidents.

Ubiquiti UniFi devices are central management points for enterprise networks, controlling Wi-Fi, switching, and routing. A compromise of a UniFi controller grants an attacker a god-like view of the network, enabling widespread lateral movement, man-in-the-middle attacks, and deployment of ransomware across the entire organization. The reported creation of rogue admin accounts confirms that attackers are establishing long-term persistence, making remediation more difficult.

Cyber Observables — Hunting Hints

The following patterns could indicate related activity:

Detection & Response

Security teams should prioritize detection of both exploitation attempts and post-compromise activity.

• Network Traffic Analysis (D3-NTA): Implement network monitoring to detect anomalous traffic to and from Lantronix and Ubiquiti devices. For Lantronix, create rules to alert on HTTP requests containing shell metacharacters in POST bodies. For Ubiquiti, baseline normal administrative traffic and alert on connections from untrusted IP ranges or attempts to establish outbound connections.
• Log Analysis: Forward logs from these devices to a central SIEM. For Lantronix, search for failed login events with suspicious usernames. For Ubiquiti, create alerts for User Account Creation events, especially for administrative accounts.
• File Integrity Monitoring: If possible, deploy file integrity monitoring on Ubiquiti devices to detect the creation of unauthorized files or webshells in web-accessible directories.
• Incident Response: If a compromise is suspected, immediately isolate the affected device from the network to prevent lateral movement. Preserve logs, memory dumps, and disk images for forensic analysis. Assume any credentials stored on or passed through the device are compromised and initiate a full credential rotation.

Mitigation

Immediate patching is the most effective mitigation. However, if that is not possible, compensating controls are critical.

1. Patch Immediately: Apply the latest firmware updates from Lantronix and Ubiquiti that address these vulnerabilities. This is the primary and most effective mitigation. (D3FEND: D3-SU - Software Update)
2. Restrict Network Access: Limit access to the management interfaces of these devices. They should not be exposed to the public internet. If remote access is required, it should be strictly controlled via a VPN with MFA. (D3FEND: D3-ITF - Inbound Traffic Filtering)
3. Network Segmentation: Isolate these devices in a segmented network zone to limit the blast radius in case of a compromise. This is especially critical for Lantronix devices in OT environments. (D3FEND: D3-NI - Network Isolation)
4. Regular Audits: Regularly audit device configurations and user accounts. Remove any unauthorized or suspicious administrator accounts on Ubiquiti devices.