A critical command injection flaw (CVSS 9.9) in Lantronix SLC8000, EMG8500/EMG7500, and several SLB/SLC console server models lets any authenticated user run arbitrary shell commands as root via an undocumented mfc eeprom write command.
What Is It
CVE-2026-80144 is an OS command injection vulnerability (CWE-78) in Lantronix autonomous out-of-band management devices. An undocumented mfc eeprom write command available from the terminal or CLI interface passes unsanitized user input directly to a system() call. Any attacker who can authenticate as any user, no administrative privileges required, can inject shell metacharacters through that parameter and execute arbitrary commands as root.
The issue was assigned by VulnCheck and published on 2026-09-22. It carries a CVSS 3.1 base score of 9.9 (CRITICAL, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and a CVSS 4.0 score of 9.4. The changed scope reflects that compromise of the console server reaches beyond the device itself.
Why It Matters
Successful exploitation results in complete loss of confidentiality, integrity, and availability on the affected device. Because these are out-of-band console servers, NVD notes that attackers can potentially impact downstream serial-attached devices; the routers, switches, PDUs, and servers the console server exists to manage. Low privileges, network attack vector, and low attack complexity make this cheap to weaponize once an attacker has any valid credential.
CISA's SSVC assessment records exploitation status as "none" and automatable as "no," with technical impact rated "total." There is no CISA KEV entry for this CVE, so active exploitation is not confirmed at this time.
What's Vulnerable
- Lantronix SLC8000: firmware before v9.7.0.2
- Lantronix EMG8500: firmware before v9.7.0.1
- Lantronix EMG7500: firmware before v9.7.0.1
- Lantronix SLB882, SLCx-03, SLCx-02: all firmware versions
Patch Status
Fixed firmware is available from Lantronix for the SLC8000 (9.7.0.2R1) and the EMG7500/EMG8500 (9.7.0.1R2) via the vendor's support FTP directories listed below. The SLB882, SLCx-03, and SLCx-02 lines are listed as affected across all firmware versions, with no fixed version identified in the supplied data. No CISA-mandated required action or due date applies, as this CVE is not in the KEV catalog.
Sources
- NVD, CVE-2026-80144: https://nvd.nist.gov/vuln/detail/CVE-2026-80144
- VulnCheck Advisory; Lantronix Out-of-Band Devices CLI Command Injection via mfc eeprom write: https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-mfc-eeprom-write
- revrb.net; Revrb Lantern: https://revrb.net/2026/09/21/revrb-lantern.html
- Lantronix SLC8000 firmware 9.7.0.2R1: https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/
- Lantronix EMG7500 firmware 9.7.0.1R2: https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
- Lantronix EMG8500 firmware 9.7.0.1R2: https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/