Lantronix firmware versions before v9.7.0.3 on the SLC8000, before v9.7.0.2 on the SLC9000, before v9.7.0.1 on the EMG8500/EMG7500, and all firmware of the SLB882 contain a server‑side request forgery in the WebSSH/WebTelnet listener. The rooturl parameter, used by the custom shellinaboxd to determine the device’s IP address, can be altered by unauthenticated users. By changing this value, an attacker can force the device to initiate outbound SSH connections to an arbitrary host or IP address. This ability allows the attacker to reach internal network endpoints otherwise unreachable from the device and to communicate or enumerate those targets.

The vulnerability affects LANTRONIX EMG7500, EMG8500, SLC8000, SLC9000, and SLB882. Firmware versions before 9.7.0.1 on EMG7500/EMG8500, before 9.7.0.3 on SLC8000, before 9.7.0.2 on SLC9000, and all firmware versions of SLB882 are impacted.

The CVSS base score of 7.7 indicates a high severity attack. Because the rooturl parameter is accepted without authentication or validation, an attacker can send a crafted HTTP request to the WebSSH interface from a host within the same network, triggering the device to initiate an outbound SSH connection to any IP chosen by the attacker. The EPSS score of < 1% and the vulnerability's absence from CISA KEV underscore that the attack vector requires network access but that actual exploitation is considered possible. This lack of authentication combined with the ability to reach arbitrary internal hosts makes exploitation likely for an attacker who has network access to the device. This can lead to internal network penetration and potential compromise of downstream targets.