A hidden mfc eeprom read command in Lantronix SLC8000, EMG8500/EMG7500, and SLB/SLC console server firmware copies unbounded user input into a fixed stack buffer, a condition that could allow any authenticated user to execute arbitrary code on the device.
What Is It
CVE-2026-80146 is a stack-based buffer overflow (CWE-121) in the terminal and CLI interfaces of several Lantronix autonomous out-of-band management devices. An undocumented mfc eeprom read command copies attacker-supplied input into a bounded stack buffer without length checks, then passes the result to a system() call. An attacker who can authenticate as any user, no administrative role required, can supply an oversized argument to trigger the overflow and potentially execute arbitrary code.
The flaw carries a CVSS 3.1 base score of 9.9 (Critical): AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and a CVSS 4.0 score of 9.4. The changed scope reflects that compromise does not stop at the console server itself.
Why It Matters
These are out-of-band management appliances: the boxes administrators reach for when everything else is down. A successful exploit means complete loss of confidentiality, integrity, and availability on the device, and per the advisory it also impacts downstream serial-attached devices; the routers, switches, PDUs, and industrial equipment wired to the console ports.
Attack complexity is low, the vector is network-reachable, and no user interaction is required. The only barrier is a valid credential, and any account will do; the advisory places no role requirement on the attacker.
No CISA KEV entry accompanies this CVE, so there is no confirmed active exploitation or federal remediation deadline at this time.
What's Vulnerable
- SLC8000: firmware before v9.7.0.2
- EMG8500: firmware before v9.7.0.1
- EMG7500: firmware before v9.7.0.1
- SLB882: all firmware versions
- SLCx-03: all firmware versions
- SLCx-02: all firmware versions
Patch Status
Fixed firmware is available from Lantronix for three product lines: SLC8000 users should move to 9.7.0.2R1, and EMG7500/EMG8500 users to 9.7.0.1R2, via the vendor FTP links below.
SLB882, SLCx-03, and SLCx-02 are listed as affected across all firmware versions with no fixed release identified. For those models, restrict CLI and terminal access to trusted management networks and audit local accounts.