CVE-2026-80143 in EMG7500
Summary
by MITRE • 09/22/2026
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Lantronix SLC8000 firmware versions prior to 9.7.0.2, EMG8500 and EMG7500 models running firmware earlier than v9.7.0.1, and all existing firmware releases for the SLB882, SLCx-03, and SLCx-02 series represents a critical command injection flaw rooted in improper input validation within undocumented system interfaces. This specific weakness is classified under CWE-78 as Improper Neutralization of Special Elements used in an OS Command, commonly referred to as OS Command Injection. The core technical failure occurs when the device processes requests directed at an internal management function labeled mfc eeprom read. Instead of sanitizing or validating the parameters passed by the user before execution, the underlying software directly concatenates this unsanitized input into a system() call string. This architectural oversight allows any authenticated entity to manipulate the command structure executed by the operating system kernel with root-level privileges.
The operational impact of this vulnerability is severe due to the privilege level granted upon exploitation. Because the vulnerable function executes commands as the root user, an attacker who successfully authenticates to either the terminal or CLI interface can achieve complete control over the affected device. This results in a total loss of confidentiality, integrity, and availability for the local system resources. Beyond the immediate compromise of the network management gateway itself, there is significant risk to downstream devices connected via serial interfaces. Since these units often serve as bridges between IP networks and legacy serial equipment such as routers, switches, or industrial control systems, an attacker can leverage this foothold to inject commands into those attached peripherals. This expands the blast radius from a single network device to potentially critical infrastructure components that may lack modern security controls.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell access such as sh or bash execution. The exploitation path relies on the attacker first obtaining valid credentials for any user account within the device's authentication framework. Once authenticated, the adversary interacts with the undocumented mfc eeprom read command to inject malicious payloads. This behavior is characteristic of lateral movement and privilege escalation scenarios where initial access through standard administrative interfaces is leveraged to gain deeper system control. The presence of an undocumented interface further complicates detection efforts as it may not be covered by standard security monitoring rules or audit logs, allowing the injection activity to proceed unnoticed until damage occurs.
Mitigation strategies must prioritize immediate firmware updates for all affected product lines. Administrators should upgrade Lantronix SLC8000 devices to version 9.7.0.2 or later, EMG8500 and EMG7500 units to v9.7.0.1 or higher, and ensure that SLB882, SLCx-03, and SLCx-02 models are updated to the latest available firmware provided by Lantronix which addresses this input validation flaw. In environments where immediate patching is not feasible due to operational constraints, network segmentation should be enforced to restrict access to these management interfaces strictly from trusted administrative subnets. Additionally, implementing strict firewall rules that limit inbound connections to only necessary ports and protocols can reduce the attack surface. Regular auditing of user accounts and enforcement of strong password policies are also essential to prevent unauthorized authentication attempts that could lead to exploitation of this command injection vector.