CVE-2026-80149 in EMG7500
Summary
by MITRE • 09/22/2026
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability described constitutes a Server-Side Request Forgery (SSRF) flaw affecting specific firmware versions of Lantronix industrial networking devices, including the SLC8000 prior to version 9.7.0.3, the EMG8500 and EMG7500 prior to version 9.7.0.1, and all firmware iterations of the SLB882 model. This security defect resides within the WebSSH or WebTelnet listener component, which is responsible for facilitating remote terminal access through a web-based interface. The core technical issue stems from how the underlying shellinaboxd service determines its own IP address during session initialization. Specifically, the application relies on an unvalidated input parameter named rooturl provided by the client's HTTP request to establish this identity. Because the server fails to validate or sanitize this parameter against a whitelist of expected internal addresses, it blindly trusts the value supplied by the attacker.
By manipulating the rooturl parameter in their initial web connection, an unauthenticated remote actor can force the device to redirect its SSH terminal session to an arbitrary host or IP address controlled by the adversary. This mechanism effectively transforms the vulnerable industrial control system into a proxy for outbound connections that bypass standard network access controls. Since the request originates from within the trusted internal network segment where these devices typically reside, the resulting connection is often permitted by firewalls and intrusion detection systems that would otherwise block direct external attempts to reach sensitive infrastructure. The attacker does not need valid credentials or prior foothold on the device; they only require network-level access to send HTTP requests to the vulnerable web interface.
The operational impact of this vulnerability is significant, particularly in industrial environments where these devices are deployed as gateways between corporate IT networks and critical OT (Operational Technology) assets. An attacker can leverage this SSRF capability to perform internal network enumeration by probing for open ports or services on adjacent systems that are not directly accessible from the internet. Furthermore, the ability to establish SSH connections allows for deeper interaction with backend servers, potentially leading to unauthorized data exfiltration, lateral movement within the network, or disruption of critical processes if the targeted endpoints include PLCs, HMIs, or other control system components. This represents a severe breach of confidentiality and integrity in environments where physical safety and operational continuity are paramount.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically involving the misuse of server-side functionality to make requests on behalf of the user without proper validation of destination addresses. In terms of adversary behavior mapping under the MITRE ATT&CK framework, this technique corresponds to T1570 Lateral Tool Transfer or potentially T1046 Network Service Discovery if used for enumeration. The lack of authentication required makes it particularly dangerous as an initial access vector in segmented networks where external-facing services are often exposed without robust zero-trust controls.
Mitigation strategies must prioritize immediate firmware updates to the specified secure versions: v9.7.0.3 or later for SLC8000 devices, and v9.7.0.1 or later for EMG8500 and EMG7500 units. For SLB882 devices, since all versions are affected until a patch is released by the vendor, alternative controls must be implemented immediately. Network segmentation should be enforced to restrict access to the web management interface of these devices only from authorized administrative workstations. Additionally, deploying Web Application Firewalls (WAF) with rules capable of detecting and blocking anomalous rooturl parameters or SSRF patterns can provide a layer of defense-in-depth. It is also critical to disable unused services such as WebSSH if they are not required for operational workflows, thereby reducing the attack surface available to potential adversaries seeking to exploit this logic flaw.