CVE-2026-80149
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. An unauthenticated attacker can modify the rooturl parameter to redirect the SSH connection to an arbitrary host or IP. This enables enumeration of and communication with internal network endpoints.
Risk Assessment
An attacker can use the device as a proxy to scan and communicate with internal network resources that are normally inaccessible. This can lead to disclosure of infrastructure information and further attacks.
Recommendation
Update Lantronix device firmware to the recommended versions (SLC8000 v9.7.0.3, SLC9000 v9.7.0.2, EMG8500/EMG7500 v9.7.0.1). Restrict access to the WebSSH/WebTelnet interface from untrusted networks.
Other vulnerabilities in Lantronix SLC/EMG/SLB firmware
See all- CVE-2026-80156Critical
Lantronix SLC8000 (before firmware v9.7.0.5), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint. An authenticated attacker can write arbitrary data to any location on the device's filesystem, leading to remote code execution.
- CVE-2026-80155Critical
Lantronix SLC8000 (before firmware v9.7.0.5), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint. An unauthenticated attacker can read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution.
- CVE-2026-80152Critical
Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker with the services permission can execute arbitrary shell commands as root via the 'set script schedule' command, which passes unsanitized user input to a system() call.
- CVE-2026-80151Critical
Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker with the services permission can execute arbitrary shell commands as root via the 'set nfs download' command, which passes unsanitized user input to a system() call.
- CVE-2026-80145Critical
Lantronix SLC8000/SLC9000 (before firmware v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker with the services permission can execute arbitrary shell commands as root via the 'set cifs password' command, which passes unsanitized user input to a system() call.
- CVE-2026-80144Critical
Lantronix SLC8000/SLC9000 (before firmware v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker can execute arbitrary shell commands as root via the undocumented 'mfc eeprom write' command, which passes unsanitized user input to a system() call.
- CVE-2026-80143Critical
Lantronix SLC8000/SLC9000 (before firmware v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker can execute arbitrary shell commands as root via the undocumented 'mfc eeprom read' command, which passes unsanitized user input to a system() call.
- CVE-2026-80150High
Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. An unauthenticated attacker can modify the rooturl parameter to redirect the Telnet connection to an arbitrary host or IP. This enables enumeration of and communication with internal network endpoints.
- CVE-2026-80148High
Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. The custom shellinaboxd builds its SSH connection target using snprintf with user-supplied input; supplying an overlong username truncates the device IP suffix and redirects the connection to an arbitrary host. This enables enumeration of and communication with internal network endpoints.
Original NVD description (English source)
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS