Lantronix EDS5000 Series (firmware 2.1.0.0R3 and below)
A serial-to-IP converter — a piece of hardware that connects older serial devices (like industrial sensors or legacy equipment) to a modern network, often found in factories, hospitals, and infrastructure environments.
Root Cause
The HTTP RPC module logs failed login attempts by building a shell command that includes the submitted username. That username is pasted directly into the command with no sanitisation (no filtering or validation of what characters are allowed). This means any input — including malicious commands — is treated as legitimate instructions by the system.
Attack Vector
An attacker sends a login request to the device's HTTP interface with a username field containing injected shell commands rather than a real username. The device's logging routine picks up that input and executes it as a root-level system command. No prior authentication is needed. The attacker walks away with full control of the device — and potentially a foothold into the broader network it sits on.
Detection Notes
- Review HTTP authentication logs for usernames containing shell metacharacters such as semicolons, pipes, or backticks.
- Monitor for unexpected outbound network connections from EDS5000 devices, particularly to unfamiliar external IPs.
- Check for new or modified system files and configuration changes on the device that no administrator initiated.
Recommended Actions
- Upgrade all EDS5000 devices to firmware version 2.2.0.0R1 immediately.
- Place EDS5000 devices behind a firewall and restrict HTTP access to trusted management IPs only.
- If patching is not immediately possible, isolate affected devices from the wider network until the upgrade is complete.