CVE-2026-80145: Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lantronix SLC8000to a version that resolves this vulnerability.Fixed in 9.7.0.2 - Upgrade
Upgrade
Lantronix EMG8500/EMG7500to a version that resolves this vulnerability.Fixed in 9.7.0.1
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker must authenticate to the device's terminal or CLI interface with an account that has the services permission. No user interaction is required after authentication.
Which devices have firmware fixes available, and which remain affected regardless of firmware version?
SLC8000 is affected before firmware v9.7.0.2, while EMG8500 and EMG7500 are affected before firmware v9.7.0.1. All firmware versions of SLB882, SLCx-03, and SLCx-02 are affected.
What is the impact if exploitation succeeds?
Injected commands execute as root on the affected device, resulting in complete compromise of confidentiality, integrity, and availability. Downstream serial-attached devices may also be impacted.
What can be done if firmware cannot be updated immediately?
Restrict terminal and CLI access to trusted administrators and review accounts holding the services permission. The vulnerability requires authenticated CLI or terminal access with that permission.