Lantronix/OpenWRT LuCI Attacks

Threat Intel
, ,
1

Last Updated: 2026-06-26T19:06:23Z

What’s Happening

Forescout reports on a recently-active exploitation campaign targeting Lantronix and OpenWRT LuCI endpoints.

The observed attacks came from two putatively distinct sources—one which was exploiting CVE-2025-67038, an authenticated command injection vulnerability in Lantronix/OpenWRT LuCI, and another which was performing brute force authentication against the endpoints, but without attempted exploitation of the same vulnerability.

More context from @darses:

Actions

If you have these devices on your network, review logs for suspicious activity. Review the IoCs listed by forescout for presence in your environment.

Also maybe don’t have these things open to the internet? Certainly not admin consoles, sheesh.

Indicators of Compromise

Since the Forescout list is truncated, here’s an extracted list of IoCs from the article.

Value Type Description
38.207.136[.]2 IPv4 Chaya_006 scanner — Apr 5-7 — Japan — CVE-2025-67038 exploitation
160.238.37[.]28 IPv4 Chaya_006 scanner — Apr 27 — South Korea — LuCI reconnaissance
59.124.166[.]52 IPv4 Chaya_006 scanner — Apr 27 — Taiwan — brute force on rpc/auth
218.13.42[.]36 IPv4 Chaya_006 scanner — Jun 3 — China — UA: openwrt-login-checker/2.0
154.219.113[.]56 IPv4 Chaya_006 C2 — Apr 5 — Hong Kong — capability test callbacks lntxe1-a
38.180.201[.]49 IPv4 Chaya_006 C2 — Apr 6 — Japan — callback path /ltrx_eds5k_rpc
hxxp://154.219.113[.]56/lntxe1 URL Chaya_006 C2 callback — wget capability test
hxxp://154.219.113[.]56/lntxe2 URL Chaya_006 C2 callback — busybox wget capability test
hxxp://154.219.113[.]56/lntxe3 URL Chaya_006 C2 callback — curl capability test
hxxp://154.219.113[.]56/lntxe4 URL Chaya_006 C2 callback — wget /dev/null capability test
hxxp://154.219.113[.]56/lntxe5 URL Chaya_006 C2 callback — /usr/bin/wget capability test
hxxp://154.219.113[.]56/lntxe6 URL Chaya_006 C2 callback — python urllib capability test
hxxp://154.219.113[.]56/lntxe7 URL Chaya_006 C2 callback — nslookup capability test
hxxp://154.219.113[.]56/lntxe8 URL Chaya_006 C2 callback — echo /dev/tcp capability test
hxxp://154.219.113[.]56/lntxe9 URL Chaya_006 C2 callback — wget capability test
hxxp://154.219.113[.]56/lntxea URL Chaya_006 C2 callback — wget capability test
hxxp://38.180.201[.]49/ltrx_eds5k_rpc URL Chaya_006 C2 callback — Lantronix EDS5000 RPC fingerprint
lntxe7.154.219.113.56.nip[.]io Domain Chaya_006 DNS callback via nip.io wildcard DNS
openwrt-login-checker/2.0 User-Agent Custom UA — brute force scanner targeting OpenWRT LuCI (Jun 3)

Notes

Thanks to @darses for the tip!

Be advised that the “IoCs” table at the bottom of that post is unusable, as something has resulted in the IPs’ first octets being stripped.

2 Likes
2

As I wrote online: “My suspicion is that the unauthenticated Remote Code Execution vulnerability CVE-2025-67038 affects a lot more device types than just the EDS5000 that is mentioned in the advisory.”

What I mean is that based on patch diffing at least 10 other device types are vulnerable, most of them without patches available. It took me ~3 hours to figure that out. An unknown Threat Actor has been exploiting these for 2,5 months by now.

Some of these devices are designed as Cellular modems for remote sites. You likely have to do some effort to restrict network access to them.

2 Likes
3

That’s interesting. Are you seeing consistencies in attack patterns/techniques with what Forescout reported?

4

My observations are not based on telemetry but on patch diffing the publicly available firmware. Both https://update.lantronix.com and ts.lantronix.com - /ftp/ contain a lot of firmware, including vulnerable and fixed versions. Patch diffing the EDS5000 versions will show the removal of the os.execution Lua function in the RPC module luci-mod-rpc_git-*-1_all.ipk. Checking the presence of the same functions in all other luci-mod-rpc_git-*-1_all.ipk files will show that this affects a bunch of other devices too. (hint: wget -r )

To clarify: I am not aware of any other indicators of compromise or (public) incident reports

1 Like
5

Lantronix released new a bunch of new firmware, fixing both CVE-2025-67038 and the second actively exploited vulnerability without CVE identifier:

I did not check all the firmware uploads nor do I have devices to actually test the fixed code, but from the looks of it this should all be good.

Device type Vulnerable version(s) Fixed version(s)
G526, G526RP, G527, G528 ? 2.6.0.4R6 (and later)
X300, X300-WiFi, X303, X304 ? 2.6.0.4R6 (and later)
E213, E214, E215, E218 ? 3.21.0.0R1 (and later)
E224, E225, E228 ? 3.21.0.0R1 (and later)
1 Like
6

The most fascinating thing about the whole situation is not that some threat actor rediscovered CVE-2025-67038 by patch diffing and started exploiting it, even before the Forescout blogpost went up. It is that both Lantronix and Forescout failed to realise there was a second endpoint with the exact same vulnerable logging code. Even after seeing the 0-day vulnerability being attacked in the Forescout honeypot, nobody noticed the issue.

image
image825×487 72.6 KB

Source: Analyzing Active Exploitation of Lantronix and OpenWRT LuCI