The vulnerability is located in the set script schedule command used by the terminal or CLI interface on several Lantronix devices. The command passes an unsanitized user supplied parameter to a system() call, enabling an attacker who has services permission to run arbitrary shell commands with root privileges. Because the command executes with full system privileges, this flaw permits complete loss of confidentiality, integrity and availability on the affected device and could compromise downstream serial‑attached peripherals.

The affected hardware models are LANTRONIX EMG7500 and EMG8500 firmware versions prior to 9.7.0.1, SLC8000 firmware versions before 9.7.0.3, SLC9000 firmware versions before 9.7.0.2, the SLB882 device in all firmware releases, and the SLCx‑02 and SLCx‑03 devices in all firmware versions. System administrators should verify that their devices are running the latest releases listed by Lantronix, which contain the command‑injection fix.

The CVSS score of 9.4 classifies the flaw as critical; the EPSS score of 2% indicates a low but nonzero probability of exploitation, suggesting that threat actors are aware or have interest in this vulnerability. The flaw is not present in the CISA KEV catalog. Exploitation requires authenticated access with the services permission, typically through the terminal or CLI interface. Once authenticated, the attacker can inject malicious commands, allowing execution as root with no further privilege escalation needed. The potential impact is total compromise of the device and downstream serial devices.