Description
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Published: 2026-09-22
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows an attacker who has authenticated with services permission to inject arbitrary shell commands into the set cifs password command, which passes unsanitized input to a system() call. This results in execution of arbitrary commands with root privileges, leading to total loss of confidentiality, integrity, and availability on the device.

Affected Systems

LANTRONIX EMG7500 and EMG8500 devices running firmware versions earlier than 9.7.0.1, LANTRONIX SLC8000 devices before firmware 9.7.0.2, and all firmware releases of LANTRONIX SLB882, SLCx-02, and SLCx-03. The affected products are EMG7500, EMG8500, SLC8000, SLB882, SLCx-02, and SLCx-03.

Risk and Exploitability

The CVSS score of 9.4 indicates critical severity. Exploitation requires only that the attacker gain a services-level account, which can be obtained by authenticating to the CLI or terminal interface. With the services permission it is trivial to enter the malicious payload. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, but the high CVSS suggests a likely impact if patched firmware is not deployed.

Generated by OpenCVE AI on September 22, 2026 at 16:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade firmware to the latest released version: for EMG7500 and EMG8500 use v9.7.0.1R2, for SLC8000 use v9.7.0.2R1, and for SLB882, SLCx-02, and SLCx-03 apply the most recent firmware releases available.
  • If immediate firmware upgrade is not possible, restrict the services permission to trusted personnel only and block remote CLI access to prevent command injection.
  • Disable or remove the set cifs password command from the configuration or patch the firmware to sanitize input before calling system().

Generated by OpenCVE AI on September 22, 2026 at 16:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Title Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-22T15:18:34.859Z

Reserved: 2026-08-25T20:43:54.261Z

Link: CVE-2026-80145

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-22T16:18:00.570

Modified: 2026-09-22T16:18:00.570

Link: CVE-2026-80145

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T17:00:12Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')