CVE-2026-80147 in SLC8000
Summary
by MITRE • 09/22/2026
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Lantronix SLC8000 firmware versions prior to v9.7.0.2, EMG8500 and EMG7500 models with firmware earlier than v9.7.0.1, as well as all existing firmware releases for the SLB882, SLCx-03, and SLCx-02 series devices, represents a critical stack-based buffer overflow condition rooted in improper input validation within undocumented system commands. This flaw specifically affects the handling of an internal mfc eeprom write command, which is designed to manage non-volatile memory storage on these industrial networking appliances. The core technical deficiency lies in the failure to enforce length constraints when processing user-supplied data destined for this EEPROM operation. Instead of validating the size of the input string against the allocated stack buffer capacity, the application directly copies the unbounded user input into a fixed-size buffer located on the program's call stack. This architectural oversight creates a classic memory corruption scenario where exceeding the buffer boundary overwrites adjacent memory locations, including critical control data such as return addresses and saved frame pointers.
From an operational perspective, this vulnerability is particularly severe because it allows for remote code execution by authenticated attackers who can access either the terminal or command-line interface of the device. The exploitation chain involves supplying a crafted, oversized payload that triggers the buffer overflow during the EEPROM write process. Once the stack memory is corrupted, the attacker gains control over the instruction pointer, enabling them to redirect program flow toward malicious shellcode injected into the same buffer or adjacent memory regions. This capability effectively bypasses standard authentication mechanisms since any valid user account can be leveraged to initiate the exploit. The consequence of successful exploitation is a complete compromise of the device's security posture, resulting in total loss of confidentiality as sensitive configuration data and credentials are exposed, loss of integrity as system files and settings are modified or destroyed, and loss of availability due to application crashes or persistent malicious control over the hardware.
The impact extends beyond the immediate host device to downstream systems connected via serial interfaces, which may also be compromised if the attacker utilizes the Lantronix appliance as a pivot point for further network intrusion. This vulnerability aligns with CWE-121, specifically describing stack-based buffer overflow conditions arising from insufficient bounds checking on user-controlled inputs. Furthermore, in the context of cyber attack frameworks such as MITRE ATT&CK, this flaw facilitates techniques associated with privilege escalation and command-line interface abuse, allowing adversaries to establish persistent access within industrial control systems or enterprise networks that rely on these serial-to-Ethernet converters for legacy device integration. The presence of an undocumented internal command exacerbates the risk by reducing visibility into potential attack surfaces during routine security audits.
Mitigation strategies must prioritize immediate firmware updates to the specified secure versions, which include proper input sanitization and length validation checks before memory allocation or copying operations occur. For environments where updating is not immediately feasible, network segmentation should be enforced to restrict access to the management interfaces of these devices from untrusted networks. Additionally, disabling unnecessary services and limiting CLI access to only essential administrative personnel can reduce the attack surface. Regular vulnerability scanning focused on industrial IoT components and strict adherence to vendor security advisories are critical for maintaining the integrity of connected infrastructure against such memory corruption exploits.