Critical Ubiquiti and Lantronix Flaws Actively Exploited: Full System Control at Risk

Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has alerted organizations about the exploitation of severe vulnerabilities in Ubiquiti UniFi OS and Lantronix EDS5000 servers. These flaws, which include access control bypasses, path traversal issues, and command injection vulnerabilities, have been actively exploited by attackers to gain unauthorized access and execute commands with elevated privileges. CISA's directive mandates federal agencies to apply security updates or vendor-recommended mitigations within three days.

What Happened

CISA has added several vulnerabilities in Ubiquiti UniFi OS and Lantronix EDS5000 servers to its Known Exploited Vulnerabilities catalog due to active exploitation by threat actors. The affected Ubiquiti flaws include:

• CVE-2026-34908: An access control bypass flaw that allows unauthenticated attackers to make unauthorized changes, potentially leading to full system compromise.
• CVE-2026-34909: A directory/path traversal vulnerability enabling attackers to access sensitive files on the underlying operating system.
• CVE-2026-34910: An improper input validation flaw allowing arbitrary command execution with elevated privileges.

For Lantronix servers, a critical-severity root-level command injection vulnerability is tracked as CVE-2025-67038. This affects model EDS5000 running firmware 2.1.0.0R3 and allows attackers to inject and execute arbitrary OS commands due to improper input sanitization in the HTTP RPC module.

Technical Details

Researchers at Bishop Fox demonstrated that these vulnerabilities could be chained together, allowing full remote code execution with elevated privileges on vulnerable UniFi OS devices. The flaws exploit weaknesses in authentication mechanisms and input validation processes, enabling attackers to bypass security controls and execute unauthorized commands.

For Lantronix EDS5000 servers, the vulnerability arises from the HTTP RPC module executing shell commands without proper sanitization of user inputs. This flaw allows an attacker to inject arbitrary commands into the username parameter, which are then executed with root privileges.

Affected Products and Fixed Versions

Ubiquiti has released security updates for the UniFi OS vulnerabilities in May. The affected versions are those prior to 5.0.8. Lantronix has also issued a patch for CVE-2025-67038, recommending users upgrade to EDS5000 version 2.2.0.0R1.

Exploitation Status

CISA has confirmed that these vulnerabilities are being actively exploited, although specific details about the exploitation methods or affected entities have not been disclosed. The "use in ransomware campaigns" flag remains set to "Unknown" for all identified flaws.

Detection Opportunities

Bishop Fox has released a detection script on GitHub designed to identify vulnerable UniFi OS instances. This Python-based tool checks for the presence of the vulnerabilities without executing any commands or altering the target state, ensuring safe assessment and production use.

# Usage example
./cve_2026_34908_check.py 192.168.1.10

The script provides various output options, including machine-readable JSON for integration into automated systems.

Defender Guidance

System administrators managing Ubiquiti UniFi OS or Lantronix EDS5000 servers should immediately apply the available updates to mitigate these vulnerabilities:

• For Ubiquiti UniFi OS: Upgrade to version 5.0.8 or later.
• For Lantronix EDS5000: Upgrade to firmware version 2.2.0.0R1.

In addition, organizations are advised to regularly scan their environments for vulnerable instances using tools like the Bishop Fox detection script and ensure that all security advisories from vendors are promptly addressed.

What Remains Unclear

While CISA has highlighted these vulnerabilities as actively exploited, specific details about the nature of the attacks or affected entities remain undisclosed. Further information on how attackers are leveraging these flaws in real-world scenarios is still needed to better understand and mitigate potential threats.