Lantronix devices suffer a path traversal vulnerability in the web management portal upload endpoint that permits an authenticated attacker to write arbitrary data to any location on the device’s filesystem. The flaw arises because the filename validation removes backslash characters but does not subsequently check for forward slashes when a backslash is detected; supplying a filename that contains both characters allows the attacker to write outside the intended upload directory to any writable path. This capability can be used to execute code remotely and results in total loss of confidentiality, integrity, and availability. In addition, the compromise could affect downstream serial‑connected devices that rely on the affected unit.

Affected vendors and products include Lantronix EMG7500, EMG8500, SLB882, SLC8000, SLC9000, SLCx-02, and SLCx-03. Firmware versions prior to 9.7.0.5 on the SLC8000, prior to 9.7.0.1 on the EMG7500 and EMG8500, prior to 9.7.0.2 on the SLC9000, and all firmware versions of the SLB882, SLCx-02, and SLCx-03 are vulnerable.

The CVSS score of 9.4 indicates critical severity, and the EPSS score is 1%. The vulnerability is not listed in the CISA KEV catalog. Attack requires authentication to the web management portal; a malicious file name that mixes backslash and forward slash characters bypasses filename validation, enabling an attacker to write arbitrary files to any writable location, which can be leveraged to execute code on the device.