CISA warns of max severity Ubiquiti flaws exploited in attacks
CISA has issued a warning about active exploitation of multiple critical vulnerabilities in Ubiquiti UniFi OS and Lantronix serial-to-ethernet servers. The Ubiquiti flaws include an access control bypass, a directory traversal, and an improper input validation leading to remote code execution. Lantronix devices are affected by a root-level command injection vulnerability in the HTTP RPC module. Patches for all these vulnerabilities have been released by the respective vendors. Federal agencies are mandated to apply these updates or mitigations within three days. No confirmed ransomware use or detailed exploitation reports have been shared by CISA.
AI Analysis
Technical Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns of active exploitation of four critical vulnerabilities affecting Ubiquiti UniFi OS and Lantronix EDS5000 devices. The Ubiquiti vulnerabilities are CVE-2026-34908 (access control bypass), CVE-2026-34909 (directory/path traversal), and CVE-2026-34910 (improper input validation enabling remote code execution). These flaws can be chained to achieve full system compromise remotely without authentication. Ubiquiti released security updates in May 2026 addressing these issues. The Lantronix vulnerability CVE-2025-67038 is a root-level command injection in the HTTP RPC module of EDS5000 firmware 2.1.0.0R3, patched in version 2.2.0.0R1. CISA added these vulnerabilities to its Known Exploited Vulnerabilities catalog and mandated rapid patching for federal agencies. No detailed exploitation data or ransomware campaign links have been disclosed.
Potential Impact
Successful exploitation of the Ubiquiti vulnerabilities can lead to unauthorized changes to UniFi OS systems, exposure of sensitive files including credentials, and full remote code execution with elevated privileges, resulting in complete system takeover. The Lantronix vulnerability allows root-level command injection via unsanitized input in the HTTP RPC module, enabling full system compromise. These vulnerabilities pose a significant risk of unauthorized access, data exposure, and control over affected devices.
Mitigation Recommendations
Security updates addressing all identified vulnerabilities have been released by Ubiquiti (May 2026) and Lantronix (firmware version 2.2.0.0R1). System administrators should apply these patches immediately. Federal agencies are required by CISA's BOD 26-04 directive to apply available updates or vendor-recommended mitigations within three days. Additionally, Bishop Fox has provided a free detection script to identify vulnerable UniFi OS instances. No vendor advisory states that no action is required; therefore, prompt patching is the primary mitigation.
CISA warns of max severity Ubiquiti flaws exploited in attacks
Description
CISA has issued a warning about active exploitation of multiple critical vulnerabilities in Ubiquiti UniFi OS and Lantronix serial-to-ethernet servers. The Ubiquiti flaws include an access control bypass, a directory traversal, and an improper input validation leading to remote code execution. Lantronix devices are affected by a root-level command injection vulnerability in the HTTP RPC module. Patches for all these vulnerabilities have been released by the respective vendors. Federal agencies are mandated to apply these updates or mitigations within three days. No confirmed ransomware use or detailed exploitation reports have been shared by CISA.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns of active exploitation of four critical vulnerabilities affecting Ubiquiti UniFi OS and Lantronix EDS5000 devices. The Ubiquiti vulnerabilities are CVE-2026-34908 (access control bypass), CVE-2026-34909 (directory/path traversal), and CVE-2026-34910 (improper input validation enabling remote code execution). These flaws can be chained to achieve full system compromise remotely without authentication. Ubiquiti released security updates in May 2026 addressing these issues. The Lantronix vulnerability CVE-2025-67038 is a root-level command injection in the HTTP RPC module of EDS5000 firmware 2.1.0.0R3, patched in version 2.2.0.0R1. CISA added these vulnerabilities to its Known Exploited Vulnerabilities catalog and mandated rapid patching for federal agencies. No detailed exploitation data or ransomware campaign links have been disclosed.
Potential Impact
Successful exploitation of the Ubiquiti vulnerabilities can lead to unauthorized changes to UniFi OS systems, exposure of sensitive files including credentials, and full remote code execution with elevated privileges, resulting in complete system takeover. The Lantronix vulnerability allows root-level command injection via unsanitized input in the HTTP RPC module, enabling full system compromise. These vulnerabilities pose a significant risk of unauthorized access, data exposure, and control over affected devices.
Mitigation Recommendations
Security updates addressing all identified vulnerabilities have been released by Ubiquiti (May 2026) and Lantronix (firmware version 2.2.0.0R1). System administrators should apply these patches immediately. Federal agencies are required by CISA's BOD 26-04 directive to apply available updates or vendor-recommended mitigations within three days. Additionally, Bishop Fox has provided a free detection script to identify vulnerable UniFi OS instances. No vendor advisory states that no action is required; therefore, prompt patching is the primary mitigation.
Technical Details
- Article Source
- {"url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-max-severity-ubiquiti-flaws-exploited-in-attacks/","fetched":true,"fetchedAt":"2026-06-24T14:39:27.859Z","wordCount":661}
Threat ID: 6a3bec20eed863c81ef9a466
Added to database: 06/24/2026, 14:39:28 UTC
Last enriched: 06/24/2026, 14:39:42 UTC
Last updated: 06/24/2026, 18:41:32 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.