CVE-2026-80150 in EMG7500
Summary
by MITRE • 09/22/2026
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability described involves a Server-Side Request Forgery (SSRF) flaw within the WebSSH and WebTelnet listeners of specific Lantronix industrial Ethernet gateway devices, including models such as the SLC8000 prior to firmware version 9.7.0.3, EMG8500 and EMG7500 prior to version 9.7.0.1, and all versions of the SLB882. This security defect stems from an improper validation mechanism in the custom shellinaboxd implementation used by these devices. Specifically, the application relies on the rooturl parameter transmitted during the initial web connection to determine its own IP address for establishing subsequent Telnet sessions. Because this input is not sufficiently sanitized or validated against a whitelist of allowed destinations, it allows unauthenticated remote attackers to manipulate the request and redirect the resulting terminal connection to arbitrary external hosts or internal network endpoints controlled by the attacker.
From a technical perspective, the core issue lies in the trust placed in client-supplied metadata without adequate server-side verification. By modifying the rooturl parameter, an adversary can force the vulnerable device to act as a proxy for Telnet traffic. This effectively turns the industrial gateway into a pivot point within the network architecture. The attacker does not need valid credentials or prior access to the internal network; they only require network-level connectivity to the management interface of the affected device and knowledge of how to craft the malicious HTTP request containing the manipulated rooturl parameter. Once executed, the device initiates an outbound connection to the specified target, allowing the attacker to interact with services running on that target as if they were connecting directly from the gateway itself.
The operational impact of this vulnerability is significant for organizations relying on these devices in critical infrastructure or industrial control systems. The primary consequence is the ability to enumerate and communicate with internal network endpoints that are otherwise isolated from external access due to firewall rules, VLAN segmentation, or other perimeter defenses. Attackers can use this capability to probe for open ports, identify running services, and potentially exploit secondary vulnerabilities on those internal hosts. This effectively bypasses network security controls designed to protect sensitive assets such as SCADA systems, PLCs, or internal database servers from external threats. The lack of authentication requirement further exacerbates the risk, allowing any entity with basic network access to leverage this flaw without detection by traditional identity-based monitoring tools.
This vulnerability aligns closely with CWE-918, which defines Server-Side Request Forgery (SSRF) flaws where a web application fetches a remote resource requested by an untrusted user but fails to prevent the server from making requests that should not be allowed. Additionally, in terms of offensive security tactics, this behavior corresponds to ATT&CK technique T1570, which covers Lateral Tool Transfer and Tunneling via protocols like Telnet or SSH to move laterally within a network environment after initial compromise. The ability to use the device as a relay for internal reconnaissance makes it particularly dangerous in segmented environments where lateral movement is typically restricted.
Mitigation strategies should prioritize immediate firmware updates to the specified secure versions, which address the input validation logic in the shellinaboxd component. For devices that cannot be immediately updated due to operational constraints or legacy support requirements, network-level controls are essential. Administrators should restrict access to the WebSSH and WebTelnet management interfaces using strict firewall rules, allowing connections only from trusted administrative subnets. Furthermore, implementing egress filtering on these devices can prevent them from initiating outbound Telnet connections to unauthorized external IPs, thereby neutralizing the exploitation vector even if the application-layer vulnerability remains present. Regular monitoring of network traffic for unusual outbound connection attempts originating from industrial gateways can also aid in early detection and response to potential exploitation activities.