The vulnerability arises from session tokens that are deterministically generated using the device model and the current time with one-second resolution. Given the limited set of active tokens, an attacker can enumerate or compute valid tokens. By crafting a URI that exploits the web server’s file-extension handling and path routing, an attacker can bypass source-IP and User-Agent validation checks, effectively authenticating without credentials. This allows unauthorized escalation to device privileges, enabling control over the device, remote configuration changes, and potential impact on downstream serial-attached devices.

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 are affected. Any device running these models is exposed to the token forgery and validation bypass described above.

The vulnerability has a CVSS score of 8.9, denoting high severity. Because it permits unauthenticated remote attackers to deduce valid session tokens, the EPSS score of less than 1% indicates a low probability of exploitation, yet the risk remains significant due to the predictable token scheme and lack of network restrictions. Attackers could exploit the flaw via standard web interfaces, crafting requests to bypass authentication and gaining elevated privileges. The flaw is not listed in the CISA KEV catalog, but the potential impact warrants immediate attention.