Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
53 vulnerabilities by LANTRONIX
CVE-2026-80156 (GCVE-0-2026-80156)
Vulnerability from nvd – Published: 2026-09-22 15:23 – Updated: 2026-09-22 15:23
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass
Summary
Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device's filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
Severity
9.1 (Critical)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device\u0027s filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:23:24.784Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-arbitrary-file-write-via-upload-filename-validation-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80156",
"datePublished": "2026-09-22T15:23:24.784Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-22T15:23:24.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80155 (GCVE-0-2026-80155)
Vulnerability from nvd – Published: 2026-09-22 15:22 – Updated: 2026-09-22 15:43
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation
Summary
Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:42 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80155",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:42:37.923706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:43:00.393Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:22:57.059Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-unauthenticated-authentication-bypass-via-snprintf-path-truncation"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80155",
"datePublished": "2026-09-22T15:22:57.059Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-22T15:43:00.393Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80154 (GCVE-0-2026-80154)
Vulnerability from nvd – Published: 2026-09-22 15:22 – Updated: 2026-09-22 17:44
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass
Summary
All firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:31.916185Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:14.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "All firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:22:33.748Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-predictable-session-token-with-validation-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80154",
"datePublished": "2026-09-22T15:22:33.748Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-22T17:44:14.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80152 (GCVE-0-2026-80152)
Vulnerability from nvd – Published: 2026-09-22 15:22 – Updated: 2026-09-22 15:52
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule
Summary
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set script schedule command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:49 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:49:36.568082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:52:24.941Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set script schedule command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:22:09.965Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-os-command-injection-via-set-script-schedule"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80152",
"datePublished": "2026-09-22T15:22:09.965Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-22T15:52:24.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80151 (GCVE-0-2026-80151)
Vulnerability from nvd – Published: 2026-09-22 15:21 – Updated: 2026-09-22 15:21
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download
Summary
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set nfs download command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.1 (Critical)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set nfs download command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:21:45.246Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-os-command-injection-via-set-nfs-download"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80151",
"datePublished": "2026-09-22T15:21:45.246Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T15:21:45.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80150 (GCVE-0-2026-80150)
Vulnerability from nvd – Published: 2026-09-22 15:21 – Updated: 2026-09-22 15:21
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter
Summary
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Severity
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:21:22.223Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webtelnet-ssrf-via-rooturl-parameter"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80150",
"datePublished": "2026-09-22T15:21:22.223Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T15:21:22.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80149 (GCVE-0-2026-80149)
Vulnerability from nvd – Published: 2026-09-22 15:20 – Updated: 2026-09-22 15:42
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter
Summary
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:41 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:41:42.950532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:42:08.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:20:57.823Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-rooturl-parameter"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80149",
"datePublished": "2026-09-22T15:20:57.823Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T15:42:08.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80148 (GCVE-0-2026-80148)
Vulnerability from nvd – Published: 2026-09-22 15:20 – Updated: 2026-09-22 17:44
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation
Summary
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80148",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:22.576164Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:20.907Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:20:33.864Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-username-truncation"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80148",
"datePublished": "2026-09-22T15:20:33.864Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T17:44:20.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80147 (GCVE-0-2026-80147)
Vulnerability from nvd – Published: 2026-09-22 15:20 – Updated: 2026-09-22 16:04
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write
Summary
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 16:02 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80147",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T16:02:05.783698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T16:04:04.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:20:01.691Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-stack-based-buffer-overflow-via-mfc-eeprom-write"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80147",
"datePublished": "2026-09-22T15:20:01.691Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T16:04:04.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80146 (GCVE-0-2026-80146)
Vulnerability from nvd – Published: 2026-09-22 15:19 – Updated: 2026-09-22 15:19
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read
Summary
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.
Severity
9.9 (Critical)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:19:38.818Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-stack-based-buffer-overflow-via-mfc-eeprom-read"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80146",
"datePublished": "2026-09-22T15:19:38.818Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T15:19:38.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80145 (GCVE-0-2026-80145)
Vulnerability from nvd – Published: 2026-09-22 15:18 – Updated: 2026-09-22 15:18
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password
Summary
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.1 (Critical)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:18:34.859Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-set-cifs-password"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80145",
"datePublished": "2026-09-22T15:18:34.859Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T15:18:34.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80144 (GCVE-0-2026-80144)
Vulnerability from nvd – Published: 2026-09-22 15:17 – Updated: 2026-09-22 15:43
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write
Summary
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:43 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80144",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:43:42.780303Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:43:55.512Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:17:45.543Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-mfc-eeprom-write"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80144",
"datePublished": "2026-09-22T15:17:45.543Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T15:43:55.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80143 (GCVE-0-2026-80143)
Vulnerability from nvd – Published: 2026-09-22 15:17 – Updated: 2026-09-22 17:44
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read
Summary
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:12.191184Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:26.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:17:21.739Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-mfc-eeprom-read"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80143",
"datePublished": "2026-09-22T15:17:21.739Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T17:44:26.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7766 (GCVE-0-2025-7766)
Vulnerability from nvd – Published: 2025-07-22 21:44 – Updated: 2025-07-23 19:57
VLAI
EPSS
VEX
Title
Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference
Summary
Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-23 19:57 UTC
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lantronix | Provisioning Manager |
Affected:
0 , ≤ 7.10.2
(custom)
|
Date Public
2025-07-22 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-7766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-23T19:57:44.156874Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-23T19:57:57.931Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Provisioning Manager",
"vendor": "Lantronix",
"versions": [
{
"lessThanOrEqual": "7.10.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Robert McLellan reported this vulnerability to CISA."
}
],
"datePublic": "2025-07-22T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eLantronix\u0026nbsp;Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.\u003c/span\u003e"
}
],
"value": "Lantronix\u00a0Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-22T21:44:10.227Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-02"
},
{
"url": "https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eLantronix has provided a fix and recommends users update to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM\"\u003ev7.10.4\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;or later.\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "Lantronix has provided a fix and recommends users update to v7.10.4 https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM \u00a0or later."
}
],
"source": {
"advisory": "ICSA-25-203-02",
"discovery": "EXTERNAL"
},
"title": "Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-7766",
"datePublished": "2025-07-22T21:44:10.227Z",
"dateReserved": "2025-07-17T14:41:27.079Z",
"dateUpdated": "2025-07-23T19:57:57.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-4338 (GCVE-0-2025-4338)
Vulnerability from nvd – Published: 2025-05-22 23:00 – Updated: 2025-05-23 13:34 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Lantronix Device Installer Improper Restriction of XML External Entity Reference
Summary
Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain credentials, access these network devices, and modify their configurations. An attacker may also gain access to the host running the Device Installer software or the password hash of the user running the application.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-23 13:34 UTC
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lantronix | Device Installer |
Affected:
0 , ≤ 4.4.0.7
(custom)
|
Date Public
2025-05-22 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-4338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-23T13:34:10.219940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-23T13:34:42.688Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Device Installer",
"vendor": "Lantronix",
"versions": [
{
"lessThanOrEqual": "4.4.0.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Robert McLellan reported this vulnerability to CISA"
}
],
"datePublic": "2025-05-22T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eLantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain credentials, access these network devices, and modify their configurations. An attacker may also gain access to the host running the Device Installer software or the password hash of the user running the application.\u003c/span\u003e"
}
],
"value": "Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain credentials, access these network devices, and modify their configurations. An attacker may also gain access to the host running the Device Installer software or the password hash of the user running the application."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-22T23:00:02.999Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-142-01"
},
{
"url": "https://www.lantronix.com/products/lantronix-provisioning-manager/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eLantronix indicates its Device Installer product has reached its end of support lifecycle in 2018. It will not receive any additional updates or security enhancements. For your security, Lantronix advises migrating to a supported solution \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.lantronix.com/products/lantronix-provisioning-manager/\"\u003eLantronix Provisioning Manager\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;as soon as possible. Using unsupported software is at user\u0027s own discretion and may leave user systems vulnerable to security issues.\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "Lantronix indicates its Device Installer product has reached its end of support lifecycle in 2018. It will not receive any additional updates or security enhancements. For your security, Lantronix advises migrating to a supported solution Lantronix Provisioning Manager https://www.lantronix.com/products/lantronix-provisioning-manager/ \u00a0as soon as possible. Using unsupported software is at user\u0027s own discretion and may leave user systems vulnerable to security issues."
}
],
"source": {
"advisory": "ICSA-25-142-01",
"discovery": "EXTERNAL"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Lantronix Device Installer Improper Restriction of XML External Entity Reference",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-4338",
"datePublished": "2025-05-22T23:00:02.999Z",
"dateReserved": "2025-05-05T16:00:14.779Z",
"dateUpdated": "2025-05-23T13:34:42.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-80156 (GCVE-0-2026-80156)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:23 – Updated: 2026-09-22 15:23
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass
Summary
Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device's filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
Severity
9.1 (Critical)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device\u0027s filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:23:24.784Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-arbitrary-file-write-via-upload-filename-validation-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80156",
"datePublished": "2026-09-22T15:23:24.784Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-22T15:23:24.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80155 (GCVE-0-2026-80155)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:22 – Updated: 2026-09-22 15:43
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation
Summary
Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:42 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80155",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:42:37.923706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:43:00.393Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:22:57.059Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-unauthenticated-authentication-bypass-via-snprintf-path-truncation"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80155",
"datePublished": "2026-09-22T15:22:57.059Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-22T15:43:00.393Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80154 (GCVE-0-2026-80154)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:22 – Updated: 2026-09-22 17:44
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass
Summary
All firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:31.916185Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:14.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "All firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:22:33.748Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-predictable-session-token-with-validation-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80154",
"datePublished": "2026-09-22T15:22:33.748Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-22T17:44:14.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80152 (GCVE-0-2026-80152)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:22 – Updated: 2026-09-22 15:52
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule
Summary
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set script schedule command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:49 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:49:36.568082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:52:24.941Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set script schedule command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:22:09.965Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-os-command-injection-via-set-script-schedule"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80152",
"datePublished": "2026-09-22T15:22:09.965Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-22T15:52:24.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80151 (GCVE-0-2026-80151)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:21 – Updated: 2026-09-22 15:21
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download
Summary
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set nfs download command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.1 (Critical)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set nfs download command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:21:45.246Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-os-command-injection-via-set-nfs-download"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80151",
"datePublished": "2026-09-22T15:21:45.246Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T15:21:45.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80150 (GCVE-0-2026-80150)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:21 – Updated: 2026-09-22 15:21
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter
Summary
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Severity
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:21:22.223Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webtelnet-ssrf-via-rooturl-parameter"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80150",
"datePublished": "2026-09-22T15:21:22.223Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T15:21:22.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80149 (GCVE-0-2026-80149)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:20 – Updated: 2026-09-22 15:42
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter
Summary
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:41 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:41:42.950532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:42:08.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:20:57.823Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-rooturl-parameter"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80149",
"datePublished": "2026-09-22T15:20:57.823Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T15:42:08.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80148 (GCVE-0-2026-80148)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:20 – Updated: 2026-09-22 17:44
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation
Summary
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80148",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:22.576164Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:20.907Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:20:33.864Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-username-truncation"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80148",
"datePublished": "2026-09-22T15:20:33.864Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T17:44:20.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80147 (GCVE-0-2026-80147)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:20 – Updated: 2026-09-22 16:04
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write
Summary
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 16:02 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80147",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T16:02:05.783698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T16:04:04.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:20:01.691Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-stack-based-buffer-overflow-via-mfc-eeprom-write"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80147",
"datePublished": "2026-09-22T15:20:01.691Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T16:04:04.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80146 (GCVE-0-2026-80146)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:19 – Updated: 2026-09-22 15:19
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read
Summary
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.
Severity
9.9 (Critical)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:19:38.818Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-stack-based-buffer-overflow-via-mfc-eeprom-read"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80146",
"datePublished": "2026-09-22T15:19:38.818Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T15:19:38.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80145 (GCVE-0-2026-80145)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:18 – Updated: 2026-09-22 15:18
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password
Summary
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.1 (Critical)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:18:34.859Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-set-cifs-password"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80145",
"datePublished": "2026-09-22T15:18:34.859Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T15:18:34.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80144 (GCVE-0-2026-80144)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:17 – Updated: 2026-09-22 15:43
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write
Summary
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:43 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80144",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:43:42.780303Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:43:55.512Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:17:45.543Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-mfc-eeprom-write"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80144",
"datePublished": "2026-09-22T15:17:45.543Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T15:43:55.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80143 (GCVE-0-2026-80143)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:17 – Updated: 2026-09-22 17:44
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read
Summary
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
6 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:12.191184Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:26.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:17:21.739Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-mfc-eeprom-read"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80143",
"datePublished": "2026-09-22T15:17:21.739Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-22T17:44:26.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7766 (GCVE-0-2025-7766)
Vulnerability from cvelistv5 – Published: 2025-07-22 21:44 – Updated: 2025-07-23 19:57
VLAI
EPSS
VEX
Title
Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference
Summary
Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-23 19:57 UTC
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lantronix | Provisioning Manager |
Affected:
0 , ≤ 7.10.2
(custom)
|
Date Public
2025-07-22 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-7766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-23T19:57:44.156874Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-23T19:57:57.931Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Provisioning Manager",
"vendor": "Lantronix",
"versions": [
{
"lessThanOrEqual": "7.10.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Robert McLellan reported this vulnerability to CISA."
}
],
"datePublic": "2025-07-22T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eLantronix\u0026nbsp;Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.\u003c/span\u003e"
}
],
"value": "Lantronix\u00a0Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-22T21:44:10.227Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-02"
},
{
"url": "https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eLantronix has provided a fix and recommends users update to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM\"\u003ev7.10.4\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;or later.\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "Lantronix has provided a fix and recommends users update to v7.10.4 https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM \u00a0or later."
}
],
"source": {
"advisory": "ICSA-25-203-02",
"discovery": "EXTERNAL"
},
"title": "Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-7766",
"datePublished": "2025-07-22T21:44:10.227Z",
"dateReserved": "2025-07-17T14:41:27.079Z",
"dateUpdated": "2025-07-23T19:57:57.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GCVE-1988-2026-0165
Vulnerability from gna-1988 – Published: 2026-09-07 13:35 – Updated: 2026-09-11 11:56
VLAI
EPSS
VEX
Title
[0day-rubbish] Lantronix EDS3000PR 3.2.0.0R2 two vulnerabilities
Summary
0day Rubbish Research Team is publicly disclosing two vulnerabilities in Lantronix EDS3000PR 3.2.0.0R2.
Vulnerability 1 — Authenticated command injection to root RCE in FsUnmount (CVSS 8.8,
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78)
Lantronix EDS3000PR is an industrial serial device server (CII/OT). Its FsUnmount page handler validates a
user-supplied path against a character bitmask that rejects most shell metacharacters but allows single quotes and
newlines, then executes /sbin/ltrx_usb_umount '/ltrx_user<path>' via /bin/sh -c. A newline breaks out of the
single-quoted command and the injected command executes as root. Verified with a root-owned marker in a qemu-arm chroot
using the real rootfs /bin/sh.
Authentication: authenticated (requires valid session)
Vulnerability 2 — Authenticated command injection to root RCE in SSL certificate import and diagnostics (CVSS 8.8,
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78)
On the same Lantronix EDS3000PR device, the SSL certificate upload handler builds openssl rsa|dsa|ec|pkcs12 -passin
pass:%s commands from the attacker-controlled certificate password and executes them via system(); the diagnostics
handler builds ping and traceroute commands from the attacker-controlled host field the same way. No shell-character
sanitization exists. An authenticated admin submits a semicolon or command-substitution payload in the password or host
field; the injected command executes as root. Verified with root markers for 5/5 SSL vectors and 3/3 diagnostics
vectors.
Authentication: authenticated (requires valid session)
Full technical analyses and reproducible proofs-of-concept:
https://0day-rubbish.com/blog/lantronix-eds3000pr-fsunmount-command-injection
https://0day-rubbish.com/blog/lantronix-eds3000pr-passin-pass-command-injection
Project archive (ongoing disclosure series):
https://github.com/Exploit-Garbage/0day-Rubbish
Vendor has been notified. CVE IDs are pending.
--
0day Rubbish Research Team
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
8 references
{
"containers": {
"cna": {
"affected": [
{
"product": "EDS3000PR",
"vendor": "Lantronix",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "0day Rubbish Research Team is publicly disclosing two vulnerabilities in Lantronix EDS3000PR 3.2.0.0R2.\n\nVulnerability 1 \u2014 Authenticated command injection to root RCE in FsUnmount (CVSS 8.8, \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78)\n\nLantronix EDS3000PR is an industrial serial device server (CII/OT). Its FsUnmount page handler validates a \nuser-supplied path against a character bitmask that rejects most shell metacharacters but allows single quotes and \nnewlines, then executes /sbin/ltrx_usb_umount \u0027/ltrx_user\u003cpath\u003e\u0027 via /bin/sh -c. A newline breaks out of the \nsingle-quoted command and the injected command executes as root. Verified with a root-owned marker in a qemu-arm chroot \nusing the real rootfs /bin/sh.\n\nAuthentication: authenticated (requires valid session)\n\nVulnerability 2 \u2014 Authenticated command injection to root RCE in SSL certificate import and diagnostics (CVSS 8.8, \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78)\n\nOn the same Lantronix EDS3000PR device, the SSL certificate upload handler builds openssl rsa|dsa|ec|pkcs12 -passin \npass:%s commands from the attacker-controlled certificate password and executes them via system(); the diagnostics \nhandler builds ping and traceroute commands from the attacker-controlled host field the same way. No shell-character \nsanitization exists. An authenticated admin submits a semicolon or command-substitution payload in the password or host \nfield; the injected command executes as root. Verified with root markers for 5/5 SSL vectors and 3/3 diagnostics \nvectors.\n\nAuthentication: authenticated (requires valid session)\n\nFull technical analyses and reproducible proofs-of-concept:\n https://0day-rubbish.com/blog/lantronix-eds3000pr-fsunmount-command-injection\n https://0day-rubbish.com/blog/lantronix-eds3000pr-passin-pass-command-injection\n\nProject archive (ongoing disclosure series):\n https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE IDs are pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:56:33Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/6"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/6"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/lantronix-eds3000pr-fsunmount-command-injection"
},
{
"url": "https://0day-rubbish.com/blog/lantronix-eds3000pr-passin-pass-command-injection"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/6"
],
"discovery": "EXTERNAL"
},
"title": "[0day-rubbish] Lantronix EDS3000PR 3.2.0.0R2 two vulnerabilities",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0165",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/6",
"automated": true,
"contentSha256": "06ba7fc5d15136ee62ee34cb74db1c10b234c3b66a7cb5d42fb6f500d9dc4431",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/6",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T15:10:49Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:35:56Z",
"dateUpdated": "2026-09-11T11:56:33Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0165"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}