A stack-based buffer overflow exists in the undocumented mfc eeprom write command used by Lantronix devices. The command copies user‑supplied data without bounds into a small stack buffer and then forwards it to a system() call, allowing an authenticated attacker to inject arbitrary code. Successful exploitation would give the attacker complete control over the affected device, leading to total loss of confidentiality, integrity, and availability for that hardware and for any serial‑attached equipment that relies on it.

Lantronix SLC8000, SLC9000, EMG7500, EMG8500, SLB882, SLCx‑02, SLCx‑03. Firmware versions at risk are all releases before v9.7.0.2 on SLC8000 and SLC9000, before v9.7.0.1 on EMG7500 and EMG8500, and every firmware on SLB882, SLCx‑02, and SLCx‑03.

The CVSS score of 9.4 marks the issue as critical. EPSS is reported at less than 1%, indicating a low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers need only valid credentials for the terminal or CLI interface and the ability to submit an oversized payload; the attack path is straightforward once credentials are obtained, so the risk remains high in environments where these interfaces are exposed to remote users.