Cyber & AI intelligence
Wasteland.
Briefs indexed2842
Issues29
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-80151 2026-09-22

CVE-2026-80151: Root Command Injection in Lantronix Out-of-Band Console Servers

"A critical command injection flaw in Lantronix SLC8000, EMG, and SLB console server firmware lets an authenticated user with the `services` permission run arbitrary shell commands as root."

A critical command injection flaw in Lantronix SLC8000, EMG, and SLB console server firmware lets an authenticated user with the services permission run arbitrary shell commands as root.

What Is It

CVE-2026-80151 is an OS command injection vulnerability (CWE-78) in Lantronix autonomous out-of-band management devices. The set nfs download command passes unsanitized user input directly to a system() call. An attacker who authenticates to the terminal or CLI interface with the services permission can inject shell metacharacters through that parameter and execute arbitrary commands as root.

The issue was disclosed through VulnCheck and published to NVD on 2026-09-22, where it currently sits in "Awaiting Analysis" status. It carries a CVSS 3.1 base score of 9.1 (CRITICAL, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and a CVSS 4.0 score of 9.4.

Why It Matters

The CVSS scope is marked Changed, and for good reason: these are out-of-band console servers. Per the advisory description, successful exploitation results in complete loss of confidentiality, integrity, and availability on the device itself, and can potentially impact downstream serial-attached devices; the routers, switches, and infrastructure the console server exists to manage. Attack complexity is low and no user interaction is required; the only barrier is holding an account with the services permission.

As of 2026-09-22, CVE-2026-80151 does not appear in the CISA Known Exploited Vulnerabilities catalog, and neither the NVD record nor the VulnCheck advisory reports exploitation in the wild.

What's Vulnerable

Those first three ranges come from the advisory, which expresses them as bare three-part versions. The remediated firmware Lantronix actually published on its support FTP site carries R-suffixed build numbers, 9.7.0.3R3 for SLC8000 and 9.7.0.1R2 for EMG7500/EMG8500. Lantronix has not published a version-mapping note reconciling the two, so the safest reading is that the R-suffixed builds are the ones carrying the fix and a bare 9.7.0.3 or 9.7.0.1 image should be treated as unpatched until the vendor confirms otherwise. Operators who need certainty on a specific build string should confirm it with Lantronix support.

Patch Status

Lantronix has published fixed firmware for three of the affected product lines: SLC8000 at 9.7.0.3R3, and EMG7500 / EMG8500 at 9.7.0.1R2. These are available from the Lantronix support FTP directories listed below. When verifying remediation, check the full build string rather than the three-part version alone; if the R-suffix reading above holds, matching only the base version would let an unpatched 9.7.0.3 or 9.7.0.1 image pass as fixed.

The SLB882, SLCx-03, and SLCx-02 lines are listed as affected across all firmware versions, and the VulnCheck advisory identifies no fixed release for them. For those devices, restricting which accounts hold the services permission and limiting network reachability of the CLI and terminal interfaces are the available levers.

Sources