← Back to CVE List
CVE-2026-80145NVD
Vulnerability Summary
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
CVSS v4.0 Base Metrics — Score 9.4 (CRITICAL)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredHigh
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)High
Integrity (Subsequent System)High
Availability (Subsequent System)High
CVSS v3.1 Base Metrics — Score 9.1 (CRITICAL)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredHigh
User InteractionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected & Patched Versions
- LANTRONIX SLC8000 < 9.7.0.2
- LANTRONIX EMG8500 < 9.7.0.1
- LANTRONIX EMG7500 < 9.7.0.1
- LANTRONIX SLB882 >= *
- LANTRONIX SLCx-03 >= *
- LANTRONIX SLCx-02 >= *
- LANTRONIX SLC8000 9.7.0.2
- LANTRONIX EMG8500 9.7.0.1
- LANTRONIX EMG7500 9.7.0.1
External References
- https://revrb.net/2026/09/21/revrb-lantern.html
- https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/
- https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/
- https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
- https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-set-cifs-password