CVE-2026-80148 in SLC8000
Summary
by MITRE • 09/22/2026
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Lantronix SLC8000 devices running firmware prior to version 9.7.0.3, EMG8500 and EMG7500 models before firmware v9.7.0.1, and all versions of the SLB882 represents a critical server-side request forgery flaw within the WebSSH and WebTelnet listener components. This security defect stems from an improper handling of user-supplied input during the construction of SSH connection targets by the custom shellinaboxd binary. Specifically, the application utilizes a snprintf function to assemble the destination address for new SSH sessions without implementing adequate bounds checking or validation on the length of the username field provided by the client. This architectural oversight creates a classic buffer manipulation scenario where an unauthenticated attacker can exploit the string formatting logic to alter the intended execution flow and network behavior of the device.
The technical mechanism of this exploitation relies on supplying an overlong username string that exceeds the expected buffer size allocated for the connection target parameters. When the snprintf function processes this oversized input, it causes a truncation or overflow effect that corrupts the subsequent data fields in memory, specifically targeting the IP address suffix portion of the SSH destination configuration. By carefully crafting the payload length and content, an attacker can effectively overwrite or redirect the intended internal device IP with their own controlled endpoint address. This manipulation allows the vulnerable firmware to establish outbound SSH connections not to the designated local management interface as originally requested by legitimate users, but instead to arbitrary hosts selected by the adversary. The flaw is particularly severe because it requires no authentication, allowing any network-accessible entity to trigger this behavior without valid credentials or prior authorization.
The operational impact of this vulnerability extends beyond simple service disruption, enabling significant reconnaissance and lateral movement capabilities within protected networks. Attackers can leverage this unauthenticated outbound connection capability to enumerate internal network endpoints that are typically isolated from external access due to firewall rules or network segmentation policies. By observing the responses returned by these internally hosted services through the forged SSH tunnel, an adversary can map out the internal topology, identify running services, and detect potential secondary vulnerabilities on other devices within the private subnet. Furthermore, if those internal endpoints have weak security postures or exposed management interfaces, the attacker could potentially use this channel to establish a foothold deeper inside the network infrastructure, effectively bypassing perimeter defenses that rely on blocking inbound connections from untrusted sources while allowing outbound traffic for legitimate updates and communications.
This vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), specifically in contexts where user input influences system commands or connection parameters without proper sanitization. It also maps to the MITRE ATT&CK technique T1572, Protocol Tunneling, as it involves establishing an encrypted channel through a trusted application to bypass security controls and reach internal resources. Additionally, aspects of CWE-20, Improper Input Validation, are evident in the failure to validate the length and content of the username field before processing it into network connection logic. The lack of authentication requirement further exacerbates the risk profile, classifying this as a high-severity issue that demands immediate remediation.
Mitigation strategies must prioritize updating the firmware on all affected Lantronix devices to versions 9.7.0.3 or later for SLC8000 models and v9.7.0.1 or later for EMG8500/EMG7500 units, as these releases address the input validation flaws in the shellinaboxd component. For devices such as the SLB882 where no patched firmware is currently available, organizations should implement strict network segmentation to limit outbound SSH traffic from IoT device subnets to only known and necessary external endpoints using firewall rules or proxy configurations. Additionally, deploying intrusion detection systems that monitor for anomalous outbound connection patterns originating from managed industrial devices can provide an additional layer of defense against exploitation attempts while patching efforts are underway. Regular security assessments and penetration testing should be conducted to verify the effectiveness of these compensating controls and ensure no other similar input handling vulnerabilities exist in adjacent services on the same hardware platform.