A critical command injection flaw in Lantronix SLC8000, EMG8500/EMG7500, and SLB/SLC legacy console servers lets an authenticated user with the "services" permission run arbitrary shell commands as root.
What Is It
CVE-2026-80145 is a CWE-78 OS command injection vulnerability in the CLI of Lantronix autonomous out-of-band management devices. The set cifs password command passes unsanitized user input directly to a system() call. An attacker who can authenticate to the terminal or CLI interface with the services permission can inject shell metacharacters into that parameter and execute arbitrary commands as root.
The flaw carries a CVSS 3.1 base score of 9.1 (CRITICAL, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and a CVSS 4.0 score of 9.4 (CRITICAL). The scope-changed rating reflects that compromise of the console server does not stay contained to the console server.
Why It Matters
Out-of-band console servers sit at the management plane. They are reachable over the network, they are frequently the last-resort access path into a rack, and they terminate serial connections to routers, switches, PDUs, and other infrastructure. Per the advisory, successful exploitation means complete loss of confidentiality, integrity, and availability on the affected device, and potentially impacts downstream serial-attached devices.
Privileges are required (PR:H), so this is not an unauthenticated internet drive-by. It is a privilege escalation from a scoped administrative role to full root on a device that brokers access to everything behind it.
The supplied source material contains no CISA KEV entry for this CVE, so there is no confirmed active exploitation and no federal remediation deadline associated with it at this time.
What's Vulnerable
- Lantronix SLC8000: firmware before v9.7.0.2
- Lantronix EMG8500: firmware before v9.7.0.1
- Lantronix EMG7500: firmware before v9.7.0.1
- Lantronix SLB882: all firmware versions
- Lantronix SLCx-03: all firmware versions
- Lantronix SLCx-02: all firmware versions
Patch Status
Fixed firmware is available from Lantronix for the three supported product lines: SLC8000 at 9.7.0.2R1, and EMG7500/EMG8500 at 9.7.0.1R2. Download links are in Sources below.
The SLB882, SLCx-03, and SLCx-02 are listed as affected across all firmware versions, with no fixed release identified in the source material. For those devices, restricting who holds the services permission and limiting network reachability of the CLI are the available levers.
The CVE was published 2026-09-22 and remains in "Awaiting Analysis" status at NVD.
Sources
- NVD, CVE-2026-80145: https://nvd.nist.gov/vuln/detail/CVE-2026-80145
- VulnCheck Advisory; Lantronix Autonomous Out-of-Band Devices CLI Command Injection via
set cifs password: https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-set-cifs-password - revrb.net, "revrb lantern" research writeup: https://revrb.net/2026/09/21/revrb-lantern.html
- Lantronix SLC8000 firmware 9.7.0.2R1: https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/
- Lantronix EMG7500 firmware 9.7.0.1R2: https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
- Lantronix EMG8500 firmware 9.7.0.1R2: https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/