CVE-2026-80146 in SLC8000
Summary
by MITRE • 09/22/2026
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability described involves a critical stack-based buffer overflow present in specific firmware versions of Lantronix industrial networking equipment, including the SLC8000 prior to version 9.7.0.2, the EMG8500 and EMG7500 prior to version 9.7.0.1, as well as all firmware iterations for the SLB882, SLCx-03, and SLCx-02 models. This flaw resides within an undocumented command interface designated as mfc eeprom read, which is accessible through both the terminal and Command Line Interface (CLI). The core technical deficiency lies in the application's failure to perform adequate bounds checking on user-supplied input before copying it into a fixed-size buffer located on the stack. When an authenticated attacker provides data that exceeds the allocated memory space of this buffer, the excess data overwrites adjacent memory locations, including critical control structures such as the return address and saved frame pointer. This corruption allows for precise manipulation of the program's execution flow, enabling the injection and subsequent execution of arbitrary machine code with the privileges of the compromised process.
From a technical perspective, the severity of this vulnerability is significantly amplified by its interaction with system-level functions. The overflowed data is not merely used to overwrite memory but is subsequently passed directly to a system() call. This design pattern effectively transforms a standard buffer overflow into a remote code execution vector, provided that authentication can be bypassed or obtained. Although the requirement for authentication might seem like a mitigating factor, the vulnerability allows attackers to authenticate as any user account on the device. In many industrial control systems and network appliances, default credentials are often left unchanged, or weak password policies allow for rapid credential compromise via brute-force attacks. Once authenticated, even at low privilege levels that have access to this specific undocumented command, an attacker can trigger the overflow and achieve complete code execution. This aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-120 Buffer Copy without Checking Size of Input and CWE-78 Improper Neutralization of Special Elements used in an OS Command, highlighting both the memory management failure and the dangerous command injection aspect.
The operational impact of this vulnerability extends far beyond the immediate compromise of the affected device itself. Lantronix devices typically serve as critical gateways or bridges between high-level IT networks and low-level serial-attached industrial equipment such as Programmable Logic Controllers (PLCs), Human-Machine Interfaces (HMIs), and other SCADA components. By achieving arbitrary code execution on these gateway devices, an attacker gains a persistent foothold within the network perimeter. This position allows for lateral movement into the operational technology sector, where security controls are often less robust than in IT environments. The complete loss of confidentiality means sensitive configuration data, proprietary process parameters, and communication keys can be exfiltrated. Loss of integrity permits the modification of device configurations or commands sent to downstream industrial equipment, potentially leading to physical damage or unsafe operating conditions. Furthermore, availability is compromised as attackers may disrupt network connectivity or crash the system, causing downtime in critical production lines.
In terms of threat modeling and adversary behavior, this vulnerability maps directly to MITRE ATT&CK techniques related to initial access and execution. Specifically, it relates to T1078 Valid Accounts, where adversaries leverage legitimate credentials to gain trust within the network environment. The exploitation method corresponds to T1203 Exploitation for Client Execution or potentially T1059 Command and Scripting Interpreter if the system() call is used to run scripts. The use of an undocumented command also suggests a lack of proper API documentation review during development, which often leads to security oversights that are difficult to detect through standard vulnerability scanning tools. Attackers with knowledge of these internal interfaces can exploit them silently, avoiding detection by network intrusion detection systems that may not inspect CLI traffic deeply or recognize the specific malformed packets associated with this overflow.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary defense is to apply the vendor-recommended firmware updates immediately for all affected models: upgrading SLC8000 devices to version 9.7.0.2 or later, EMG8500/EMG7500 devices to version 9.7.0.1 or later, and ensuring SLB882, SLCx-03, and SLCx-02 devices are running the latest available firmware from Lantronix. For systems that cannot be immediately patched due to operational constraints, network segmentation is critical. These gateway devices should reside in a dedicated DMZ or industrial zone with strict access control lists (ACLs) limiting CLI and terminal access only to authorized management stations. Additionally, enforcing strong password policies and disabling unused user accounts reduces the attack surface for credential-based exploitation. Monitoring network traffic for unusual patterns associated with undocumented commands or abnormal buffer sizes can also provide early warning indicators of attempted exploitation. Regular vulnerability assessments focused on industrial control system components are essential to identify such legacy flaws before they can be leveraged by threat actors targeting critical infrastructure.