CVE-2026-80150 - Vulnerability Details

- Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter

Description

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.

Published: 2026-09-22

Score: 7.7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The affected Lantronix devices, namely EMG7500, EMG8500, SLC8000, SLC9000, and SLB882, expose a server‑side request forgery through the WebSSH/WebTelnet interface. By manipulating the rooturl parameter, an unauthenticated attacker can cause the device to open Telnet connections to arbitrary hosts. This allows the adversary to discover or communicate with internal network endpoints that would otherwise be unreachable, potentially facilitating further compromise.

Affected Systems

Lantronix EMG7500, EMG8500 before firmware v9.7.0.1, SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, and all firmware revisions of SLB882 contain this SSRF flaw.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity. While the EPSS score indicates a very low but non-zero exploitation probability of <1%, the lack of a KEV listing suggests no public exploits are yet reported, but the vulnerability can be exploited over the network with no authentication. The attack vector is inferred to be remote, via the publicly reachable web interface.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

LANTRONIX

SLC8000

unaffected

Version	Status	Constraints
`0`	affected	< 9.7.0.3

LANTRONIX

EMG8500

unaffected

Version	Status	Constraints
`0`	affected	< 9.7.0.1

LANTRONIX

EMG7500

unaffected

Version	Status	Constraints
`0`	affected	< 9.7.0.1

LANTRONIX

SLB882

unknown

Version	Status	Constraints
`*`	affected	—

LANTRONIX

SLC9000

unaffected

Version	Status	Constraints
`0`	affected	< 9.7.0.2

No data.

Vendor Product Confidence Versions

Lantronix

Emg7500

100%

Version	Status	Scheme	Platform
`[0,9.7.0.1)`	affected	generic	—

Lantronix

Emg8500

100%

Version	Status	Scheme	Platform
`[0,9.7.0.1)`	affected	generic	—

Lantronix

Slb882

100%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Lantronix

Slc8000

100%

Version	Status	Scheme	Platform
`[0,9.7.0.2)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest firmware releases (EMG7500/EMG8500 at least v9.7.0.1R2, SLC8000 at least v9.7.0.3R3, or newer) to remove the rooturl SSRF flaw.
If a patch cannot be applied immediately, disable the WebTelnet/WebSSH listener or block its traffic through the device configuration or associated firewall rules.
Limit access to the device’s web interface to trusted management hosts by implementing access control lists or firewall filtering so that only authorized IP addresses can reach the vulnerable service.

Generated by OpenCVE AI on September 26, 2026 at 05:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0058.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://revrb.net/2026/09/21/revrb-lantern.html
https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/
https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/
https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/
https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webtelnet-ssrf-via-rooturl-parameter

History

Thu, 24 Sep 2026 19:30:00 +0000

Type	Values Removed	Values Added
Description	Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.	Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
References		https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/

Wed, 23 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 22 Sep 2026 19:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Lantronix Lantronix emg7500 Lantronix emg8500 Lantronix slb882 Lantronix slc8000
Vendors & Products		Lantronix Lantronix emg7500 Lantronix emg8500 Lantronix slb882 Lantronix slc8000

Tue, 22 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Title		Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter
Weaknesses		CWE-918
References		https://revrb.net/2026/09/21/revrb-lantern.html https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webtelnet-ssrf-via-rooturl-parameter
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N'}`

Subscriptions

Lantronix Emg7500 Emg8500 Slb882 Slc8000

MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-09-22T15:21:22.223Z

Updated: 2026-09-26T13:29:53.179Z

Reserved: 2026-08-25T20:43:54.261Z

Link: CVE-2026-80150

Vulnrichment

Updated: 2026-09-23T15:46:35.224Z

NVD

Status : Awaiting Analysis

Published: 2026-09-22T16:18:01.313

Modified: 2026-09-26T14:16:59.203

Link: CVE-2026-80150

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-26T06:00:06Z

Weaknesses

CWE-918
Server-Side Request Forgery (SSRF)

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object