A critical (CVSS 9.1) OS command injection flaw in Lantronix SLC8000, EMG8500/EMG7500, and SLB882/SLCx console server families lets an authenticated user with the "services" permission run arbitrary shell commands as root.
What Is It
The vulnerability is a CWE-78 OS command injection in the set script schedule command. The device passes unsanitized user input from that command's parameter directly to a system() call, so an attacker who can reach the terminal or CLI interface and holds the services permission can break out of the intended command and execute arbitrary shell commands with root privileges.
CVSS v3.1 rates it 9.1 CRITICAL (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); the CVSS v4.0 score from the same source is 9.4 CRITICAL. Attack vector is network, attack complexity is low, no user interaction is required, and scope is changed; high privileges are the only real barrier.
Why It Matters
These are autonomous out-of-band management devices, which sit on the management plane precisely so they remain reachable when everything else is down. Root code execution means complete loss of confidentiality, integrity, and availability on the device itself.
The changed scope (S:C) in the CVSS vector indicates impact reaching beyond the vulnerable component. In this class of deployment, the adjacent components are the downstream serial-attached devices; the routers, switches, PDUs, and servers the console server is wired into, each reachable through the console session the compromised device brokers. That downstream exposure follows from the scoring and the deployment model; no Lantronix security advisory is among the available sources, so it is not a vendor-stated impact.
CISA's SSVC decision point data records exploitation as "none" and automatable as "no," with technical impact "total." There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed.
What's Vulnerable
- Lantronix SLC8000; firmware before v9.7.0.3
- Lantronix EMG8500; firmware before v9.7.0.1
- Lantronix EMG7500; firmware before v9.7.0.1
- Lantronix SLB882; all firmware versions
- Lantronix SLCx-03; all firmware versions
- Lantronix SLCx-02; all firmware versions
Note: NVD's structured affected-version data lists SLC8000 as affected below 9.7.0.2, while the CVE description and the vendor's published firmware directory point to 9.7.0.3.
Patch Status
Fixed firmware is available from Lantronix: SLC8000 9.7.0.3R3, and EMG7500/EMG8500 9.7.0.1R2. The SLB882, SLCx-03, and SLCx-02 lines are listed as affected in all firmware versions, with no fixed release identified in the supplied data; restrict the services permission and limit management-interface exposure on those models.
Sources
- NVD, CVE-2026-80152: https://nvd.nist.gov/vuln/detail/CVE-2026-80152
- VulnCheck Advisory; Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule: https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-os-command-injection-via-set-script-schedule
- revrb.net; Revrb Lantern: https://revrb.net/2026/09/21/revrb-lantern.html
- Lantronix SLC8000 firmware 9.7.0.3R3: https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/
- Lantronix EMG7500 firmware 9.7.0.1R2: https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
- Lantronix EMG8500 firmware 9.7.0.1R2: https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/