CVE-2025-67038
Actively exploited. CVE-2025-67038 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-06-23) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
Public exploit code is available. Proof-of-concept or working exploit code for CVE-2025-67038 is indexed in GitHub PoC. Expect opportunistic scanning and exploitation attempts — prioritize remediation.
Serial number: AV26-241 Date: March 16, 2026 Updated: June 23, 2026 Between March 9 and 15, 2026, CISA published ICS advisories to address vulnerabilities in the following products: Apeman Cameras ID71 – all versions Ceragon Siklu MultiHaul and EtherHaul Series – multiple versions Honeywell IQ4x BMS Controller – multiple versions and models Inductive Automation Ignition Software – versions prior to 8.3.0 Lantronix EDS3000PS – version 3.1.0.0R2 Lantronix EDS5000 – version 2.1.0.0R3 Siemens Heliox EV Chargers – version Heliox Mobile DC 40 kW EV Charging Station Siemens Heliox EV Chargers – version Heliox Flex 180 kW EV Charging Station Siemens RUGGEDCOM APE1808 Devices – all versions Siemens SIDIS Prime – versions prior to V4.0.800 Siemens SIMATIC – multiple versions and models Trane Tracer Concierge – versions prior to v6.3.2310 Trane Tracer SC – versions prior to v4.4_SP7 Trane Tracer SC+ – versions prior to v6.3.2310 Update 1 On June 23, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-67038 affecting Lantronix EDS5000 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations and apply the necessary updates if available. CISA ICS Advisories CISA KEV: CVE-2025-67038
CSIRTS triage
- What
- This advisory covers vulnerabilities in various control systems and devices.
- Who is affected
- Multiple control systems and devices from various manufacturers are affected.
- Urgency
- Remediation is necessary as exploitation is known and vulnerabilities exist.
- Action
- Review and apply necessary updates for affected devices.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2025-67038
Get an email if CVE-2025-67038 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 55% of all EPSS-scored CVEs.
Exploit availability
Public exploit or proof-of-concept code for CVE-2025-67038 is indexed in these free datasets. Available exploit code raises real-world risk independent of the CVSS score.
- GitHub PoCPublic proof-of-concept repositories on GitHub reference this CVE.look it up ↗
Advisory coverage (3)
- unknownexploited[Control systems] CISA ICS security advisories (AV26–241) – Update 1cccs · 2026-06-23
- highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa · 2026-06-23
- criticalexploitedCVE-2025-67038: Lantronix EDS5000 Code Injection Vulnerabilitycisa-kev · 2026-06-23
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2025-67038)