CVE-2026-80150: Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lantronix SLC8000to a version that resolves this vulnerability.Fixed in 9.7.0.3 - Upgrade
Upgrade
Lantronix EMG8500/EMG7500to a version that resolves this vulnerability.Fixed in 9.7.0.1
Event History
Frequently Asked Questions
Which device versions are affected?
SLC8000 firmware before 9.7.0.3 and EMG8500 or EMG7500 firmware before 9.7.0.1 are affected. All firmware versions of the SLB882 are affected.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker can exploit the issue remotely without user interaction by modifying the rooturl parameter used by the WebSSH/WebTelnet listener.
What access can an attacker gain through this vulnerability?
The attacker can cause the device to establish Telnet connections to an arbitrary attacker-controlled host or IP address. This can be used to enumerate or communicate with internal network endpoints that are otherwise inaccessible.