CISA warns of max severity Ubiquiti flaws exploited in attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of hackers actively exploiting flaws in Ubiquity UniFi OS and Lantronix serial-to-ethernet servers. According to the BOD 26-04 directive, federal agencies have three days to apply available security updates or vendor-recommended mitigations. The Ubiquiti flaws that CISA added to its catalog of Known Exploited Vulnerabilities are: Ubiquiti released security updates for the three vulnerabilities in May, warning that they could be exploited remotely without privileges. Researchers at Bishop Fox later demonstrated that the three flaws could be chained to achieve full remote code execution with elevated privileges on vulnerable UniFi OS devices. Bishop Fox has also released a free detection script on GitHub to help defenders discover vulnerable instances in their environment. The security issue exploited in Lantronix servers is tracked as CVE-2025-67038, and is a critical-severity root-level command injection affecting model EDS5000 running firmware 2.1.0.0R3. The vulnerability exists in the HTTP RPC module, which executes a shell command to log failed authentication attempts. The supplied username is concatenated directly into the shell command without proper sanitization, allowing an attacker to inject arbitrary operating system commands. Lantronix released a released a patch for CVE-2025-67038 and recommends users to upgrade to EDS5000 version 2.2.0.0R1. CISA has not shared any details about the observ...