Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Lantronix devices let logged‑in users take full control

CVE-2026-80147 · published 27 days ago
Summary

Older versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882 and SLCx‑03/02 allow anyone who can log into the device’s command line to send overly long data that overruns memory and runs their own code. This can give an attacker complete access to the device and any serial‑connected equipment. Update the firmware to the latest version or restrict command‑line access to trusted users only.

What to do
  • Update lantronix slc8000 to version 9.7.0.2 or later.
  • Update lantronix emg8500 to version 9.7.0.1 or later.
  • Update lantronix emg7500 to version 9.7.0.1 or later.
Affected software
VendorProductAffected versions
lantronix slc8000 < 9.7.0.2
lantronix emg8500 < 9.7.0.1
lantronix emg7500 < 9.7.0.1
lantronix slb882 All versions
lantronix slcx-03 All versions
lantronix slcx-02 All versions
Original advisory text
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published22 Sep 2026
Updated19 Oct 2026
First seen22 Sep 2026
Sources
CVE-2026-80147 · NVD
CVE-2026-80147 · MITRE
Track software like this
Free during beta