CVE-2026-80144 in SLC8000
Summary
by MITRE • 09/22/2026
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability described constitutes a critical command injection flaw affecting several models within the Lantronix industrial networking portfolio, specifically including firmware versions prior to v9.7.0.2 for the SLC8000 series, pre-v9.7.0.1 for the EMG8500 and EMG7500 gateways, and all existing firmware iterations of the SLB882, SLCx-03, and SLCx-02 devices. This security defect is rooted in an undocumented internal command interface designated as mfc eeprom write, which serves a legitimate purpose for managing device configuration but fails to implement adequate input validation mechanisms. The core technical flaw lies in the direct pass-through of unsanitized user-supplied parameters into a system() function call within the underlying operating environment. This architectural oversight allows an attacker who has successfully authenticated to either the terminal or command-line interface (CLI) to inject arbitrary shell commands that are executed with root-level privileges, effectively bypassing standard access controls and privilege separation boundaries inherent in the device's security model.
From a technical perspective, this vulnerability aligns closely with CWE-78, which defines Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The exploitation vector relies on the attacker leveraging valid credentials to interact with the CLI or terminal interface, where they can manipulate specific parameters associated with the mfc eeprom write operation. Because the input is not sanitized for special shell characters such as semicolons, pipes, or ampersands, these characters are interpreted by the underlying command interpreter rather than treated as literal data. This allows the injection of complex command sequences that extend beyond simple string manipulation into full arbitrary code execution. The presence of this flaw in undocumented interfaces highlights a significant gap in secure development lifecycle practices, where internal APIs were not subjected to rigorous security testing or input validation protocols before deployment.
The operational impact of this vulnerability is severe and comprehensive, resulting in a complete loss of confidentiality, integrity, and availability for the affected devices. Since the injected commands execute with root privileges, an attacker gains full control over the device's operating system. This capability enables the exfiltration of sensitive configuration data, including network credentials and encryption keys, thereby compromising confidentiality. Integrity is compromised as attackers can modify firmware settings, alter routing tables, or install persistent backdoors that survive reboots. Availability is threatened through the potential for denial-of-service attacks by crashing critical services or corrupting system files. Furthermore, because these devices often serve as gateways in industrial control systems and enterprise networks, the compromise of a single device can lead to lateral movement across the network segment, impacting downstream serial-attached devices that rely on the gateway for connectivity and data translation.
In terms of threat modeling, this vulnerability maps directly to MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques such as sh or bash execution. The attack pattern involves an authenticated actor leveraging a local application interface to execute system commands, which falls under the Initial Access and Execution tactics within the cyber kill chain. The use of undocumented interfaces for critical operations represents a deviation from best practices in industrial IoT security, where all administrative functions should be exposed through well-documented, audited APIs with strict input validation. The ability to escalate privileges to root via this method underscores the importance of principle of least privilege implementation, ensuring that even authenticated users do not have unrestricted access to low-level system commands unless absolutely necessary for operational requirements.
Mitigation strategies must prioritize immediate firmware updates to the specified secure versions: v9.7.0.2 or later for SLC8000 devices and v9.7.0.1 or later for EMG8500 and EMG7500 units, while SLB882, SLCx-03, and SLCx-02 users must await the release of patched firmware from Lantronix as no current version is considered safe. In environments where immediate patching is not feasible due to operational constraints, network segmentation should be enforced to isolate these devices from untrusted networks, restricting CLI access to a dedicated management VLAN with strict firewall rules that limit exposure to authorized administrative workstations only. Additionally, implementing strong authentication policies and monitoring for anomalous command-line activity can help detect exploitation attempts early. Long-term remediation requires Lantronix to conduct a thorough review of all undocumented internal commands, removing or hardening them against injection attacks, and integrating static application security testing into their firmware development pipeline to prevent similar flaws in future releases.