A filename validation flaw in the web management portal of several Lantronix console server and out-of-band management devices lets an authenticated attacker write arbitrary files anywhere on the filesystem, which can lead to remote code execution.
What Is It
CVE-2026-80156 is a path traversal vulnerability (CWE-22) in the upload endpoint of the Lantronix web management portal. The upload filename validation strips backslash characters but does not subsequently re-check for forward slashes once a backslash has been detected. By supplying a filename containing both characters, an attacker escapes the intended upload directory and writes arbitrary data to any writable path on the device.
The result is an arbitrary file write that can plausibly be escalated to remote code execution. Exploitation requires authentication, but no user interaction, and the attack is network-reachable with low complexity.
VulnCheck ([email protected]) assigned a CVSS v3.1 base score of 9.1 (Critical): CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, and a CVSS v4.0 score of 9.4 (Critical). The scope-changed rating reflects impact beyond the vulnerable component itself.
Why It Matters
These are out-of-band management devices: the equipment administrators rely on to reach infrastructure when everything else is down. Successful exploitation means complete loss of confidentiality, integrity, and availability on the affected device, and can potentially impact downstream serial-connected devices attached to the console server.
CVE-2026-80156 does not appear in the CISA Known Exploited Vulnerabilities catalog, and there is no confirmation of active exploitation at this time. NVD status is "Awaiting Analysis."
What's Vulnerable
- Lantronix SLC8000: firmware before v9.7.0.5
- Lantronix EMG8500: firmware before v9.7.0.1
- Lantronix EMG7500: firmware before v9.7.0.1
- Lantronix SLB882: all firmware versions
- Lantronix SLCx-03: all firmware versions
- Lantronix SLCx-02: all firmware versions
Patch Status
Fixed firmware is published on Lantronix's support FTP for the SLC8000 (9.7.0.5R2) and EMG7500/EMG8500 (9.7.0.1R2) lines; operators of those models should upgrade. No fixed version is listed for SLB882, SLCx-03, or SLCx-02; all firmware versions are marked affected, so restricting network access to the management portal is the only available mitigation for those models.