Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026

Part of the CVE-2025-67038 story · since 23 Jun

Quiet for 20 weekslast report 25 Jun9 articles4 outlets
23 Jun · CISA first10 Aug3 Sep27 SepNowThis article8th of 9
  • Tue 23 Jun, 19:39 UTC. CISA, first report. Lantronix EDS5000 Command Injection Flaw Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 23 Jun, 19:47 UTC. CISA. Lantronix EDS5000 Command Injection Flaw Under Active Attack. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 02:02 UTC. SecurityOnline, its first report on the story. CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 03:41 UTC. SecurityOnline. Flaw in AVer PTC500S cameras allows remote code execution. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 04:11 UTC. SecurityOnline. Google Search Now Saves Your Uploaded Media to Train AI. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 04:11 UTC. SecurityOnline. Lantronix, UniFi flaws surface as Outlook Mac reply glitch seen. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 08:13 UTC. SecurityOnline. SmartRAT ClickFix targets Brazilian banks with AI spoofed domains. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 10:32 UTC. Security Affairs, its first report on the story. CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026. Cites a CVE in CISA KEV. This article, 8th of 9.
  • Thu 25 Jun, 12:01 UTC. SecurityWeek, its first report on the story. Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning. Cites a CVE in CISA KEV.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, specifically targeting Ubiquiti UniFi OS and Lantronix EDS5000. The vulnerabilities include:

1. CVE-2025-67038: A code injection flaw in Lantronix EDS5000, which lacks proper username sanitization allowing arbitrary command execution.

2. CVE-2026-34908: An improper access control vulnerability in Ubiquiti UniFi OS with a critical CVSS score of 10.0, enabling unauthorized system modifications.

3. CVE-2026-34909: A path traversal vulnerability in UniFi OS, though details are limited.

4. CVE-2026-34910: Another critical flaw (CVSS 10.0) in UniFi OS leading to potential command injection. Federal agencies must remediate these vulnerabilities by June 26, 2026, to safeguard against potential exploits.

How the story developed

All 9 articles
Quiet for 20 weekslast report 25 Jun9 articles4 outlets

9 articles from 4 outlets since 23 Jun. Quiet since 25 Jun. This was the 8th report, 15 hours after the first.

Now23 Jun242526278 Nov9First reportCISA · 23 Jun, 19:39This article8th of 9 · day 1
  • Tue 23 Jun, 19:39 UTC. CISA, first report. Lantronix EDS5000 Command Injection Flaw Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 23 Jun, 19:47 UTC. CISA. Lantronix EDS5000 Command Injection Flaw Under Active Attack. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 02:02 UTC. SecurityOnline, its first report on the story. CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 03:41 UTC. SecurityOnline. Flaw in AVer PTC500S cameras allows remote code execution. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 04:11 UTC. SecurityOnline. Google Search Now Saves Your Uploaded Media to Train AI. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 04:11 UTC. SecurityOnline. Lantronix, UniFi flaws surface as Outlook Mac reply glitch seen. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 08:13 UTC. SecurityOnline. SmartRAT ClickFix targets Brazilian banks with AI spoofed domains. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 10:32 UTC. Security Affairs, its first report on the story. CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 2026. Cites a CVE in CISA KEV. This article, 8th of 9.
  • Thu 25 Jun, 12:01 UTC. SecurityWeek, its first report on the story. Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Tue 23 JunDay 02
    1. Lantronix EDS5000 Command Injection Flaw Under Active Attack19:39 · CISA · official · First report · CISA alert · Known exploited CVE
    2. Lantronix EDS5000 Command Injection Flaw Under Active Attack19:47 · CISA · official · Known exploited CVE
  2. Wed 24 JunDay 16
    1. CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog02:02 · SecurityOnline · Known exploited CVE
    2. Flaw in AVer PTC500S cameras allows remote code execution03:41 · SecurityOnline · Known exploited CVE
    3. CISA flags Ubiquiti, Lantronix flaws; urges US patch by June 202610:32 · Security Affairs · Known exploited CVE · This article, 8th of 9
    Show 3 more from 24 Jun
    1. Google Search Now Saves Your Uploaded Media to Train AI04:11 · SecurityOnline · Known exploited CVE
    2. Lantronix, UniFi flaws surface as Outlook Mac reply glitch seen04:11 · SecurityOnline · Known exploited CVE
    3. SmartRAT ClickFix targets Brazilian banks with AI spoofed domains08:13 · SecurityOnline · Known exploited CVE
  3. Thu 25 JunDay 21
    1. Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning12:01 · SecurityWeek · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in