A CVSS 10.0 authentication bypass in the web management portal of Lantronix SLC8000, EMG8500/EMG7500, and legacy SLB/SLC console servers lets unauthenticated attackers read configuration files and write to arbitrary filesystem paths, resulting in remote code execution.
What Is It
The web configuration server on affected Lantronix devices builds the session cookie file path with snprintf into a fixed-size buffer. By supplying a cookie value of a specific length, an attacker forces the path to truncate at the required delimiter and then uses path traversal to point authentication validation at an arbitrary on-disk file; for example, the local user database. That redirect bypasses all session checks.
With authentication defeated, the upload endpoint allows unauthenticated attackers to read sensitive configuration files and write files to arbitrary filesystem locations, leading to remote code execution. The flaw is classified as CWE-22 (path traversal) and was disclosed through VulnCheck.
Why It Matters
CVSS v3.1 scores this at 10.0 CRITICAL with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with scope change. CVSS v4.0 also rates it 10.0 CRITICAL, though v4.0 uses a different metric set and the v3.1 vector above does not carry over to it. CISA's SSVC assessment marks the vulnerability as automatable: yes with technical impact: total, while exploitation is currently rated none.
The CVE does not appear in the CISA KEV catalog, so there is no confirmation of active exploitation at this time.
The consequence is complete loss of confidentiality, integrity, and availability on the affected device, and potentially on downstream serial-connected devices. These are out-of-band management appliances, so a compromise reaches whatever infrastructure they are attached to.
What's Vulnerable
| Product | Affected versions |
|---|---|
| Lantronix SLC8000 | before firmware v9.7.0.5 |
| Lantronix EMG8500 | before firmware v9.7.0.1 |
| Lantronix EMG7500 | before firmware v9.7.0.1 |
| Lantronix SLB882 | all firmware versions |
| Lantronix SLCx-03 | all firmware versions |
| Lantronix SLCx-02 | all firmware versions |
Patch Status
Fixed firmware is published by Lantronix: SLC8000 at 9.7.0.5R2, and EMG7500/EMG8500 at 9.7.0.1R2 (download links below). SLB882, SLCx-03, and SLCx-02 are listed as affected across all firmware versions, and no fixed version has been identified for them. The NVD entry is still Awaiting Analysis as of 2026-09-22.
Sources
- NVD, CVE-2026-80155: https://nvd.nist.gov/vuln/detail/CVE-2026-80155
- VulnCheck Advisory; Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation: https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-unauthenticated-authentication-bypass-via-snprintf-path-truncation
- Researcher writeup; revrb.net: https://revrb.net/2026/09/21/revrb-lantern.html
- Lantronix SLC8000 9.7.0.5R2 firmware: https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/
- Lantronix EMG7500 9.7.0.1R2 firmware: https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
- Lantronix EMG8500 9.7.0.1R2 firmware: https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/