The vulnerability occurs when the web configuration server builds the session cookie file path using snprintf into a fixed‑size buffer. By supplying a cookie value of a specific length, an unauthenticated attacker can force the buffer to truncate the path at the delimiter, enabling path traversal that bypasses session validation. This lets the attacker read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The flaw manipulates authentication checks by redirecting to an arbitrary on‑disk file such as the local user database, and is classified as a path traversal (CWE‑22). The affected firmware includes SLC8000 prior to 9.7.0.5, SLC9000 prior to 9.7.0.2, EMG8500/EMG7500 prior to 9.7.0.1, and all releases of SLB882, SLCx‑03, and SLCx‑02. It can compromise confidentiality, integrity, and availability of the device and potentially downstream serial‑connected devices.

Affecting Lantronix SLC8000 firmware versions earlier than 9.7.0.5, EMG8500 and EMG7500 firmware earlier than 9.7.0.1, and all firmware releases of SLB882, SLCx‑03, and SLCx‑02, which are autonomous out‑of‑band devices that provide serial‑to‑network interfaces.

The flaw carries a CVSS score of 10, indicating critical severity, and is not listed in the CISA KEV catalog. EPSS score of 2% indicates a low but non‑zero probability of exploitation. An unauthenticated attacker with web‑portal access can exploit the path traversal, upload malicious content, and achieve remote code execution. The ability to read configuration files also enables a full compromise of the device and potentially downstream serial‑connected systems.