Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Lantronix devices let logged‑in users run code remotely

CVE-2026-80146 · published 27 days ago
Summary

Certain Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx‑03 and SLCx‑02 units let anyone who can log in to the command line send overly long data that can take control of the device. This could let an attacker read, change or stop the device and any equipment attached to it. Apply the latest firmware updates from Lantronix as soon as possible and restrict console access to trusted users only.

What to do
  • Update lantronix slc8000 to version 9.7.0.2 or later.
  • Update lantronix emg8500 to version 9.7.0.1 or later.
  • Update lantronix emg7500 to version 9.7.0.1 or later.
Affected software
VendorProductAffected versions
lantronix slc8000 < 9.7.0.2
lantronix emg8500 < 9.7.0.1
lantronix emg7500 < 9.7.0.1
lantronix slb882 All versions
lantronix slcx-03 All versions
lantronix slcx-02 All versions
Original advisory text
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published22 Sep 2026
Updated19 Oct 2026
First seen22 Sep 2026
Sources
CVE-2026-80146 · NVD
CVE-2026-80146 · MITRE
Track software like this
Free during beta