CVE-2026-80149: Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lantronix SLC8000to a version that resolves this vulnerability.Fixed in 9.7.0.3 - Upgrade
Upgrade
Lantronix EMG8500/EMG7500to a version that resolves this vulnerability.Fixed in 9.7.0.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Devices running the WebSSH/WebTelnet listener are exposed: SLC8000 firmware earlier than 9.7.0.3, EMG8500 and EMG7500 firmware earlier than 9.7.0.1, and SLB882 devices running any firmware version.
Does exploitation require authentication or user interaction?
No. The issue is reachable over the network and can be exploited by an unauthenticated attacker without user interaction.
What can an attacker do with this vulnerability?
An attacker can alter the rooturl parameter so the device initiates an SSH connection to an arbitrary attacker-selected host or IP. This can be used to enumerate or communicate with internal endpoints that are otherwise inaccessible.
What should be patched first?
Upgrade SLC8000 devices to firmware 9.7.0.3 or later and EMG8500/EMG7500 devices to firmware 9.7.0.1 or later. The provided information states that all SLB882 firmware versions are affected and does not identify a fixed version.