CVE-2026-80144 - Vulnerability Details

- Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write

Description

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.

Published: 2026-09-22

Score: 9.4 Critical

EPSS: 1.5% Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a command injection flaw in an undocumented mfc eeprom write command that passes unsanitized user input to a system() call, affecting Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-02, and SLCx-03 firmware versions listed. An authenticated attacker with terminal or CLI access can craft input to execute arbitrary shell commands as root, leading to total compromise of confidentiality, integrity, availability of the device and potentially downstream serial devices.

Affected Systems

LANTRONIX routers and devices including EMG7500, EMG8500, SLB882, SLC8000, SLC9000, SLCx-02, and SLCx-03. Firmware versions before v9.7.0.2 on SLC8000 and SLC9000, before v9.7.0.1 on the EMG series, and all versions of SLB882, SLCx-02, and SLCx-03 are impacted.

Risk and Exploitability

The CVSS score of 9.4 indicates a critical severity. The EPSS score is 2%, indicating a low but non‑zero likelihood of exploitation, and this issue is not listed in CISA's KEV catalog. Attackers must first authenticate to the device using the CLI or terminal interface; the vulnerability is exercised through the machine's command shell. Once authenticated, the attacker can inject any shell command, leading to full system compromise.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

LANTRONIX

SLC8000

unaffected

Version	Status	Constraints
`0`	affected	< 9.7.0.2

LANTRONIX

EMG8500

unaffected

Version	Status	Constraints
`0`	affected	< 9.7.0.1

LANTRONIX

EMG7500

unaffected

Version	Status	Constraints
`0`	affected	< 9.7.0.1

LANTRONIX

SLB882

unknown

Version	Status	Constraints
`*`	affected	—

LANTRONIX

SLCx-03

unknown

Version	Status	Constraints
`*`	affected	—

LANTRONIX

SLCx-02

unaffected

Version	Status	Constraints
`*`	affected	—

LANTRONIX

SLC9000

unaffected

Version	Status	Constraints
`0`	affected	< 9.7.0.2

No data.

Vendor Product Confidence Versions

Lantronix

Emg7500

100%

Version	Status	Scheme	Platform
`[0,9.7.0.1)`	affected	generic	—

Lantronix

Emg8500

100%

Version	Status	Scheme	Platform
`[0,9.7.0.1)`	affected	generic	—

Lantronix

Slb882

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Lantronix

Slc8000

100%

Version	Status	Scheme	Platform
`[0,9.7.0.2)`	affected	generic	—

Lantronix

Slcx-02

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Lantronix

Slcx-03

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the firmware of affected devices to the latest available versions (SLC8000 to v9.7.0.2, EMG7500/EMG8500 to v9.7.0.1, and all SLB882, SLCx-02, SLCx-03 to the most recent releases).
If an immediate firmware upgrade is not feasible, restrict the device’s CLI access to trusted administrative accounts only and apply network segmentation to limit exposure of the affected devices.
As a temporary control, consider disabling or blocking the mfc eeprom write command through device configuration or firewall rules to prevent the injection vector.

Generated by OpenCVE AI on September 26, 2026 at 15:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0151.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://revrb.net/2026/09/21/revrb-lantern.html
https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/
https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/
https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/
https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-mfc-eeprom-write

History

Thu, 24 Sep 2026 19:15:00 +0000

Type	Values Removed	Values Added
Description	Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.	Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
References		https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/

Wed, 23 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 22 Sep 2026 19:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Lantronix Lantronix emg7500 Lantronix emg8500 Lantronix slb882 Lantronix slc8000 Lantronix slcx-02 Lantronix slcx-03
Vendors & Products		Lantronix Lantronix emg7500 Lantronix emg8500 Lantronix slb882 Lantronix slc8000 Lantronix slcx-02 Lantronix slcx-03

Tue, 22 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Title		Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write
Weaknesses		CWE-78
References		https://revrb.net/2026/09/21/revrb-lantern.html https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-mfc-eeprom-write
Metrics		cvssV3_1 `{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`

Subscriptions

Lantronix Emg7500 Emg8500 Slb882 Slc8000 Slcx-02 Slcx-03

MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-09-22T15:17:45.543Z

Updated: 2026-09-24T19:02:33.612Z

Reserved: 2026-08-25T20:43:54.261Z

Link: CVE-2026-80144

Vulnrichment

Updated: 2026-09-22T15:43:49.052Z

NVD

Status : Awaiting Analysis

Published: 2026-09-22T16:17:59.303

Modified: 2026-09-24T19:17:17.183

Link: CVE-2026-80144

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-26T15:30:08Z

Weaknesses

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object