editor [at] industrialsecops

BRIDGE:BREAK in the Wild: The Lantronix Serial-to-IP Flaw That Gives Attackers Root Access to Your OT Network

•

Industrial Secops

BRIDGE:BREAK in the Wild: The Lantronix Serial-to-IP Flaw That Gives Attackers Root Access to Your OT Network

CVE-2025-67038  |  Forescout BRIDGE:BREAK  |  CISA KEV  |  Published June 28, 2026

BRIDGE:BREAK CVE-2025-67038 Lantronix Attack Flow Diagram
CVE-2025-67038 attack flow — Internet-exposed Lantronix EDS5000 to root shell to OT network lateral movement and serial data manipulation

TL;DR FOR DEFENDERS

A critical unauthenticated command injection vulnerability in Lantronix EDS5000 serial-to-IP converters (CVE-2025-67038) is now actively exploited in the wild. Forescout confirmed exploitation in their honeypot as early as April 5, 2026 — weeks before public disclosure — meaning attackers reverse-engineered the patch to build the exploit. CISA added it to the Known Exploited Vulnerabilities catalog on June 23, 2026. Patch immediately to firmware 2.2.0R1 (EDS5000) or 3.2.0.0R2 (EDS3000).

What Happened

On April 21, 2026, Forescout’s Vedere Labs published BRIDGE:BREAK – a comprehensive research report disclosing 20 new vulnerabilities across Lantronix and Silex serial-to-IP converters. But before the ink was dry on that report, attackers were already in the wild.

Forescout’s honeypot infrastructure (designated Chaya_006) detected active exploitation of CVE-2025-67038 on April 5, 2026 – sixteen days before Forescout published the technical details, but after Lantronix released the patch on February 20, 2026. The window tells the story: attackers did not wait for Forescout’s writeup. They reverse-engineered Lantronix’s firmware update to identify what was fixed, then built their own exploit.

The activity was not random. Forescout observed automated command injection testing combined with Lantronix-specific device fingerprinting – behavior consistent with a targeted, mission-aware campaign, not a broad vulnerability scanner. C2 infrastructure traced to IP addresses registered in Hong Kong and Japan.

On June 23, 2026, CISA formally added CVE-2025-67038 to its Known Exploited Vulnerabilities (KEV) catalog and directed all federal civilian agencies to patch within 72 hours – a deadline that underscores the severity of active exploitation.

Technical Breakdown

The Device: Lantronix EDS5000

Serial-to-IP converters (serial device servers) are hardware appliances that bridge legacy serial protocols (RS-232, RS-485, RS-422) to modern TCP/IP networks. They are the invisible glue holding decades of OT infrastructure together — enabling PLCs, RTUs, SCADA sensors, and other serial-based field devices to communicate over Ethernet without costly replacement.

The Lantronix EDS5000 is widely deployed across industrial, healthcare, energy, retail, and telecommunications sectors. ZoomEye data shows thousands of Lantronix devices directly internet-exposed, with the majority in the United States.

CVE-2025-67038: Unauthenticated OS Command Injection

The flaw is a command injection vulnerability in the username parameter of the EDS5000 web management interface. An unauthenticated attacker can inject arbitrary OS commands that execute with root privileges — no credentials required. An attacker with network access can:

  • Execute arbitrary commands as root
  • Establish persistent C2 access on the device
  • Use the device as a pivot point for lateral movement into the OT network
  • Upload malicious firmware to brick or weaponize the device
  • Intercept or manipulate serial data flowing through the converter

Forescout observed exploit payloads downloading stage-2 binaries from C2 infrastructure at 154[.]219[.]113[.]56 (Hong Kong) and 38[.]180[.]201[.]49 (Japan).

⚠ EXPLOITATION TIMELINE

Feb 20, 2026 Lantronix releases patched firmware (2.2.0R1 / 3.2.0.0R2)
Apr 5, 2026 Forescout honeypot (Chaya_006) confirms active exploitation
Apr 21, 2026 Forescout publishes BRIDGE:BREAK technical details
Jun 23, 2026 CISA adds CVE-2025-67038 to KEV catalog; 72-hr patch deadline

BRIDGE:BREAK: The Broader Vulnerability Class

CVE-2025-67038 is one of 20 vulnerabilities in the BRIDGE:BREAK set, affecting Lantronix and Silex products. The full class includes:

Vulnerability Class Potential Impact
OS command injection / RCE Root shell access, C2 implant installation
Authentication bypass Unauthenticated access to management interface
Arbitrary file upload Malicious firmware or script delivery
Firmware tampering Persistent implant, bricking, data manipulation
Denial-of-service Silence hospital devices, halt industrial telemetry

In healthcare attack scenarios, Forescout demonstrated how malicious firmware could cause serial-to-IP converters to stop responding on the network — silencing lab analyzers, halting infusion pump calibration, cutting patient monitor telemetry, and rendering surgical lighting controllers unresponsive.

Historical context: Serial-to-IP converters were exploited by Russian threat actors in the 2015 Ukraine power grid attack — the first confirmed cyberattack to cause a physical power outage — and more recently in attacks on Polish energy facilities. BRIDGE:BREAK arrives with this threat history already established.

Who Is Affected

Sector How Serial-to-IP Converters Are Used
Industrial / Manufacturing Connecting legacy PLCs, RTUs, DCS controllers to SCADA over IP
Energy & Utilities Substation automation, smart grid metering, SCADA telemetry
Water Treatment Sensor data aggregation, chemical dosing control systems
Healthcare Lab analyzer interfaces, patient monitors, infusion pump management
Transportation Rail signaling, traffic management, port infrastructure
Telecommunications Network element management, legacy circuit interfaces

Why This Matters

The Patch-Reverse-Engineer Gap Is Real

The exploitation timeline of CVE-2025-67038 illustrates a dangerous trend: sophisticated actors monitor vendor patch releases, reverse-engineer the fix to identify the underlying vulnerability, and weaponize it before defenders have deployed the patch. The gap between Lantronix’s update and Forescout’s disclosure was supposed to protect defenders. Instead, it became an active exploitation window of at least 44 days.

This is the n-day race playing out in OT environments — where patch deployment timelines are measured in months, not days, and where downtime windows for applying firmware updates are rare and carefully managed.

Serial-to-IP Converters: Invisible, Pervasive, and Unmonitored

These devices are routinely absent from OT asset inventories. They don’t appear on SCADA dashboards. They don’t trigger alerts in most ICS monitoring platforms. Yet they sit directly in the data path between field devices and control systems — making them ideal vectors for data manipulation attacks that conceal dangerous physical conditions.

An attacker who controls a serial-to-IP converter controls the sensor data pipeline. They can inject false readings to suppress alarms while physical processes drift outside safe operating bounds — with no indication to operators until equipment fails or a safety incident occurs.

Internet Exposure Is the Root Problem

Forescout’s OSINT analysis found that open-source intelligence tools can surface Lantronix device details — including internal IP addresses, model information, and photographs from electrical substations and water treatment facilities. With thousands of units directly internet-exposed, CVE-2025-67038 is a low-effort, high-impact entry point into critical infrastructure.

MITRE ATT&CK for ICS Mapping

Technique ID Description
Internet Accessible Device T0883 Thousands of EDS5000 units directly exposed via internet
Exploit Public-Facing Application T0819 Unauthenticated RCE via web management interface
Remote Services T0886 Device used as C2 bridge and lateral movement pivot
Program Upload T0845 Malicious firmware delivery for persistent compromise
Device Restart/Shutdown T0816 DoS via firmware brick or forced device reboot
Network Connection Enumeration T0840 Lantronix-specific fingerprinting in Chaya_006 activity
Modify Parameter T0836 False sensor readings injected upstream to SCADA

Defensive Recommendations

Immediate (Do Now)

  1. Patch immediately. Apply Lantronix firmware 2.2.0R1 for EDS5000 series and 3.2.0.0R2 for EDS3000 series (released February 20, 2026).
  2. Remove internet exposure. Serial-to-IP converters should never be directly internet-accessible. Audit firewall rules and network edge configurations now.
  3. Inventory all serial device servers. Use passive network discovery to enumerate Lantronix, Silex, Moxa, Digi, and Advantech devices across your environment.
  4. Block C2 IOCs. Add 154[.]219[.]113[.]56 and 38[.]180[.]201[.]49 to firewall block lists and SIEM correlation rules.

Short-Term (Within 30 Days)

  1. Segment serial device servers. Place converters in dedicated VLANs. They should only communicate with the specific serial equipment they serve and explicitly authorized upstream systems.
  2. Restrict management interface access. Web UI access should be limited to a dedicated management workstation via ACL. No broad network access.
  3. Replace default credentials. Audit all serial device servers for factory-default credentials. Enforce strong password policies.
  4. Enable monitoring. Configure SIEM/IDS rules to alert on anomalous HTTP requests to management interfaces, unexpected outbound connections, and command injection patterns.

Long-Term (Strategic)

  1. Build a serial device server asset register. These devices are often procured by operations teams without security visibility. Establish a formal process to track all converters, firmware versions, and network exposure.
  2. Plan serial protocol modernization. Evaluate whether legacy serial devices can be replaced with natively networked OT devices that support modern authentication and encryption.
  3. Apply CISA’s CI Fortify guidance. CISA’s Critical Infrastructure Fortify program addresses OT isolation and recovery for geopolitical conflict scenarios — relevant given the state-adjacent C2 infrastructure in the Chaya_006 activity cluster.

IndustrialSecOps Analyst Assessment

SEVERITY RATING: CRITICAL

CVE-2025-67038 sits at the intersection of three converging threats: unauthenticated root RCE, active exploitation confirmed in the wild, and a device class that is pervasively deployed and systematically undermonitored in OT environments. The Chaya_006 activity cluster’s Lantronix-specific targeting behavior — combined with state-adjacent C2 infrastructure — suggests this is not opportunistic botnet activity. It is purposeful reconnaissance and access staging in industrial and critical infrastructure environments.

The BRIDGE:BREAK research is a wake-up call for a largely invisible layer of OT infrastructure. The 2015 Ukraine attack proved this device class is a viable OT intrusion vector — and now there is an active exploit in the wild, with C2 infrastructure already deployed.

Bottom line: If you have Lantronix EDS3000 or EDS5000 devices and have not patched, assume you are a target. Patch now. Remove internet exposure today.

Sources and Further Reading

Leave a Reply