Lantronix firmware versions before 9.7.0.2 for the SLC8000/SLC9000 line, before 9.7.0.1 for EMG7500/EMG8500, and all releases of SLB882, SLCx-02, and SLCx-03 contain a command‑injection flaw. An attacker who has services‑level access can authenticate to the terminal or CLI interface and supply crafted input to the set cifs password command. The parameter is passed unsanitized to a system() call, allowing the attacker to execute arbitrary shell commands as root. This results in total loss of confidentiality, integrity, and availability on the device and may affect downstream serial‑attached equipment.

LANTRONIX EMG7500 and EMG8500 devices running firmware versions earlier than 9.7.0.1, LANTRONIX SLC8000 devices before firmware 9.7.0.2, and all firmware releases of LANTRONIX SLB882, SLCx-02, and SLCx-03.

The CVSS score of 9.4 indicates critical severity. Exploitation requires that the attacker obtain a services‑level account, which can be achieved by authenticating to the CLI or terminal interface. With that permission it is trivial to inject malicious payloads into the set cifs password command. The EPSS score of 2% indicates a low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS suggests a likely impact if patched firmware is not deployed.