CVE-2026-80156: Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass
Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device's filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lantronix SLC8000to a version that resolves this vulnerability.Fixed in 9.7.0.5 - Upgrade
Upgrade
Lantronix EMG8500/EMG7500to a version that resolves this vulnerability.Fixed in 9.7.0.1
Event History
Frequently Asked Questions
Which devices can be remediated by upgrading firmware?
SLC8000 devices are affected before firmware v9.7.0.5, and EMG8500 and EMG7500 devices are affected before firmware v9.7.0.1. SLB882, SLCx-03, and SLCx-02 are affected on all firmware versions.
What access does an attacker need to exploit this issue?
An attacker needs authenticated access to the web management portal and must be able to submit a crafted filename to its upload endpoint. No user interaction is required.
What is the potential impact after successful exploitation?
The attacker can write arbitrary data to writable locations on the device filesystem, which can lead to remote code execution and complete compromise of confidentiality, integrity, and availability. Downstream serial-connected devices may also be affected.
How does the filename-validation bypass work?
The upload endpoint strips backslash characters but fails to check forward slashes afterward when a backslash was present. A filename containing both backslashes and forward slashes can therefore traverse outside the intended upload directory.