Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Lantronix devices allow unauthenticated file upload and code execution

CVE-2026-80155 · published 27 days ago
Summary

Older firmware on Lantronix SLC8000, EMG8500, EMG7500, SLB882 and related models lets anyone without a login upload files and read configuration data through the web interface. This is because the device builds a session file name incorrectly, allowing an attacker to trick it into using any file on the device, which can lead to full control of the equipment. Update the firmware to the latest version released by Lantronix or apply their recommended patches to close the flaw.

What to do
  • Update lantronix slc8000 to version 9.7.0.5 or later.
  • Update lantronix emg8500 to version 9.7.0.1 or later.
  • Update lantronix emg7500 to version 9.7.0.1 or later.
Affected software
VendorProductAffected versions
lantronix slc8000 < 9.7.0.5
lantronix emg8500 < 9.7.0.1
lantronix emg7500 < 9.7.0.1
lantronix slb882 All versions
lantronix slcx-03 All versions
lantronix slcx-02 All versions
Original advisory text
Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation
Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published22 Sep 2026
Updated19 Oct 2026
First seen22 Sep 2026
Sources
CVE-2026-80155 · NVD
CVE-2026-80155 · MITRE
Track software like this
Free during beta