CVE-2026-80155 in EMG7500
Summary
by MITRE • 09/22/2026
Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The identified security flaw represents a critical authentication bypass within the web management portal of several Lantronix industrial networking products, specifically affecting SLC8000 firmware versions prior to 9.7.0.5, EMG8500 and EMG7500 devices running firmware earlier than v9.7.0.1, as well as all historical firmware releases for the SLB882, SLCx-03, and SLCx-02 models. This vulnerability stems from a fundamental implementation error in how the web configuration server handles session management cookies during file upload operations. The core technical deficiency lies in the use of snprintf to construct the file path for storing or validating session cookie data using a fixed-size buffer without adequate bounds checking relative to the input length and subsequent delimiter requirements. When an attacker supplies a specially crafted cookie value with a specific, excessive length, it triggers a buffer truncation event that alters the expected string termination behavior. This manipulation allows the resulting file path to bypass standard validation logic by effectively redirecting the authentication check away from the legitimate session token toward arbitrary on-disk files, such as local user databases or other configuration artifacts stored in accessible directories.
From a technical perspective, this flaw is classified under CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write, which often leads to memory corruption or logic bypasses depending on the specific execution context. The attacker leverages path traversal techniques facilitated by the truncated path construction to manipulate where the system looks for authentication credentials. By pointing the validation mechanism toward a file that does not require valid session tokens or contains predictable content, the attacker successfully circumvents all session-based access controls. This results in an unauthenticated state being established within the administrative interface of the device. The vulnerability is particularly severe because it allows remote code execution without any prior authentication credentials, effectively rendering traditional perimeter security measures ineffective against this specific attack vector.
The operational impact of exploiting this vulnerability is catastrophic for both confidentiality and integrity, with significant implications for availability. An unauthenticated attacker can read sensitive configuration files that may contain hardcoded passwords, network topology details, or cryptographic keys, leading to a complete loss of data confidentiality. Furthermore, the ability to upload arbitrary files to any location on the filesystem enables the persistence of malicious payloads, such as backdoors or rootkits, which compromises system integrity and allows for persistent remote code execution. This level of control permits the attacker to fully compromise the affected device, potentially using it as a pivot point to attack downstream serial-connected devices that rely on these industrial controllers for communication and data processing. The breach undermines the trust model inherent in Industrial Control Systems (ICS) environments where physical safety and operational continuity are paramount.
In alignment with industry threat modeling frameworks, this vulnerability maps directly to MITRE ATT&CK technique T1078 Valid Accounts, specifically involving unauthorized access through authentication bypass mechanisms, as well as T1505 Server Software Component for the installation of persistent backdoors via file upload capabilities. The exploitation path also aligns with CWE-269 Improper Privilege Management due to the elevation of privileges from unauthenticated user to full system administrator equivalent. To mitigate this risk, organizations must immediately apply the specified firmware updates: version 9.7.0.5 or later for SLC8000 devices and v9.7.0.1 or later for EMG8500/EMG7500 units. For legacy SLB882, SLCx-03, and SLCx-02 hardware where updates may not be available, immediate network segmentation is required to restrict access to the management interface exclusively from trusted administrative subnets using firewall rules or VLAN isolation. Additionally, implementing strict input validation on all web portal endpoints that handle file uploads and session cookies can prevent similar exploitation patterns in future firmware iterations.