CISA confirmed on June 23, 2026 that four vulnerabilities are under active exploitation, adding them to the Known Exploited Vulnerabilities catalog with a three-day federal remediation deadline that expired June 26. The set combines a critical OT/ICS bridge device flaw with three maximum-severity vulnerabilities in Ubiquiti UniFi OS, touching network infrastructure across enterprise, critical infrastructure, and operational technology environments.
Lantronix EDS5000: OT Bridging Device at Root Risk
CVE-2025-67038 carries a CVSS score of 9.8 and affects the Lantronix EDS5000 Series Device Server. The vulnerability is a code injection flaw in the HTTP RPC module: the device fails to sanitise the username parameter before concatenating it into a shell command used for logging failed authentication attempts. An unauthenticated network attacker can inject arbitrary OS commands through this parameter and achieve root-level code execution on the device.
The EDS5000’s role in industrial deployments makes this significant beyond its CVSS score. These devices function as serial-to-IP bridges, connecting legacy serial equipment — PLCs, RTUs, flow controllers, SCADA sensors — to IP networks. They sit directly in the communication path between operational technology assets and the enterprise network, making them high-value targets for adversaries seeking lateral movement from IT into OT, or for establishing persistent access to industrial communication infrastructure.
Lantronix has released a patch in version 2.2.0.0R1. Federal Civilian Executive Branch agencies were required to remediate by June 26 under BOD 26-04.
Ubiquiti UniFi OS: Three CVEs, All Maximum Severity
CISA simultaneously flagged three Ubiquiti UniFi OS vulnerabilities, all assessed at CVSS 10.0 — the maximum score.
CVE-2026-34908 is an improper access control vulnerability that allows an unauthenticated attacker to make unauthorised administrative changes to a UniFi OS system, potentially leading to full system compromise.
CVE-2026-34909 is a path traversal flaw enabling an attacker to read sensitive files from the underlying operating system.
CVE-2026-34910 is an improper input validation vulnerability that enables injection and execution of arbitrary OS commands.
The three flaws can be chained: access control bypass creates an attack surface; path traversal enables credential or configuration extraction; command injection delivers code execution. Exploitation has been confirmed in the wild. Every UniFi OS-powered device class is affected, including Cloud Gateways, Network Controllers, Protect NVR systems, Access Hubs, and Talk appliances — making the exposure widespread across organisations that have deployed Ubiquiti’s infrastructure stack.
Sector Impact
OT/ICS operators should treat the Lantronix advisory as a priority. Serial device servers of this class are common in energy, water, manufacturing, and transport control environments. An unpatched internet-accessible EDS5000 represents a direct bridgehead into serial OT infrastructure from the IP network.
Network and security operations teams managing Ubiquiti deployments face a broad remediation scope given how widely UniFi OS is deployed across corporate network infrastructure, physical security systems, and campus environments. The combination of authentication bypass and command injection at CVSS 10.0, with confirmed active exploitation, warrants immediate action regardless of internet exposure.
Recommended Actions
- Identify all Lantronix EDS5000 devices in the environment; prioritise any internet-exposed or DMZ-adjacent instances. Apply firmware version 2.2.0.0R1 immediately.
- Audit Ubiquiti UniFi OS deployment footprint. Apply vendor patches across all UniFi OS device classes. Restrict management interface access to trusted networks; remove any public-facing admin access pending patch application.
- Review network segmentation between UniFi-managed network infrastructure and OT segments. A compromised network controller in scope of a UniFi deployment provides an attacker with significant visibility into traffic flows and access policies.
- Check vendor patch portals for both Lantronix and Ubiquiti for additional guidance; CISA’s KEV entry links to vendor advisories.