CVE-2026-80155
CriticalCVSS 10.0Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
Lantronix SLC8000 (before firmware v9.7.0.5), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint. An unauthenticated attacker can read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution.
Risk Assessment
An unauthenticated attacker can gain complete control of the device (loss of confidentiality, integrity, and availability) and potentially impact downstream serial-connected devices.
Recommendation
Update firmware to v9.7.0.5 (SLC8000), v9.7.0.2 (SLC9000), or v9.7.0.1 (EMG8500/EMG7500); for SLB882/SLCx-03/SLCx-02 no fix exists — consider replacing devices or disabling the web portal.
Other vulnerabilities in Lantronix SLC/EMG/SLB firmware
See all- CVE-2026-80156Critical
Lantronix SLC8000 (before firmware v9.7.0.5), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint. An authenticated attacker can write arbitrary data to any location on the device's filesystem, leading to remote code execution.
- CVE-2026-80152Critical
Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker with the services permission can execute arbitrary shell commands as root via the 'set script schedule' command, which passes unsanitized user input to a system() call.
- CVE-2026-80151Critical
Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker with the services permission can execute arbitrary shell commands as root via the 'set nfs download' command, which passes unsanitized user input to a system() call.
- CVE-2026-80145Critical
Lantronix SLC8000/SLC9000 (before firmware v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker with the services permission can execute arbitrary shell commands as root via the 'set cifs password' command, which passes unsanitized user input to a system() call.
- CVE-2026-80144Critical
Lantronix SLC8000/SLC9000 (before firmware v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker can execute arbitrary shell commands as root via the undocumented 'mfc eeprom write' command, which passes unsanitized user input to a system() call.
- CVE-2026-80143Critical
Lantronix SLC8000/SLC9000 (before firmware v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker can execute arbitrary shell commands as root via the undocumented 'mfc eeprom read' command, which passes unsanitized user input to a system() call.
- CVE-2026-80150High
Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. An unauthenticated attacker can modify the rooturl parameter to redirect the Telnet connection to an arbitrary host or IP. This enables enumeration of and communication with internal network endpoints.
- CVE-2026-80149High
Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. An unauthenticated attacker can modify the rooturl parameter to redirect the SSH connection to an arbitrary host or IP. This enables enumeration of and communication with internal network endpoints.
- CVE-2026-80148High
Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. The custom shellinaboxd builds its SSH connection target using snprintf with user-supplied input; supplying an overlong username truncates the device IP suffix and redirects the connection to an arbitrary host. This enables enumeration of and communication with internal network endpoints.
Original NVD description (English source)
Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS