CVE-2025-67038 is a pre-authentication command injection in the HTTP RPC module of network appliances (including the EDS5032). The vulnerability lives in the authentication failure logging path — when a login fails, the code executes a shell command to write the username to a log file, and the username is concatenated directly into that command without sanitization. This means every failed login attempt is an active injection vector. No credentials, no session, no foothold required — just an HTTP request with a malformed username.
The CVSS 9.8 is well-deserved, but the score misses what actually matters: this isn't a vulnerability in some obscure API endpoint that might get called. It's triggered every time someone guesses wrong at the login prompt. The attack surface is the login page itself.
Root-level execution compounds the severity. These aren't general-purpose servers — an EDS5032 typically serves as a console server or KVM-over-IP gateway, sitting in front of sensitive infrastructure. Compromising it doesn't mean 'owning an IoT device.' It means direct access to serial console ports, network configuration, and often a pivot point into the systems operators use to manage everything else.
CISA added this to the KEV, indicating active exploitation in the wild. That shifts the posture from 'patch eventually' to 'assume compromise.'
For detection: the system() call executes synchronously before the HTTP response returns, spawning a child shell from the HTTP daemon process. If you have host-based telemetry on adjacent systems with log aggregation, look for anomalous subprocess spawning from network appliance HTTP processes. Most SOC playbooks don't alert on this — the instrumentation gap, not technical opacity, is why this evades detection.
For immediate controls: network segmentation with aggressive egress filtering on the management VLAN is the only realistic mitigation until firmware ships. Pre-auth root RCE is only as dangerous as the device's reach to the serial console servers and KVM gateways it fronts. If the compromised appliance can't reach the infrastructure it protects, lateral movement becomes substantially harder.
Patch timelines for embedded firmware are measured in quarters, not weeks. If you're waiting for a vendor patch, you're already in the wrong posture.