Lantronix devices have a server‑side request forgery vulnerability in their WebSSH/WebTelnet listener that is triggered by a truncated username input. By supplying an overlong username, the device’s shellinaboxd component builds the SSH target using a snprintf call with user‑supplied input, causing the IP suffix to be truncated and redirecting the outgoing SSH connection to an attacker‑controlled endpoint. This allows enumeration or communication with internal network nodes that are otherwise inaccessible, potentially giving an adversary a foothold for further lateral movement or data exfiltration.

The flaw affects LANTRONIX devices including the EMG7500 and EMG8500 before firmware v9.7.0.1, the SLC8000 before firmware v9.7.0.3, the SLC9000 before firmware v9.7.0.2, and all firmware versions of the SLB882. The vulnerability exists in the WebSSH/WebTelnet listener component of each device.

The CVSS score of 7.7 indicates a high severity level. The EPSS score of < 1 % reflects a very low probability of exploitation, though not zero, and the vulnerability is not listed in CISA's KEV catalog. A likely attack path involves a network‑accessible WebSSH interface, where an unauthenticated attacker sends a specially crafted username to trigger the SSRF. Once exploited, the device can connect to any target host, enabling internal network discovery or further attacks. The risk is greatest in environments where these devices are exposed to untrusted networks or where outbound SSH traffic from the device is unrestricted.