Description

Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-22T16:17:57.543Z",
  "pubdate": "2026-09-22T16:17:57.543Z",
  "executiveSummary": "A critical command injection vulnerability exists within multiple Lantronix console management products, including the SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02.\nThe vulnerability originates from the improper sanitization of user-supplied input provided to an undocumented 'mfc eeprom read' command.\nAn authenticated attacker can leverage this flaw to execute arbitrary shell commands with root privileges.\nThe impact includes a complete loss of confidentiality, integrity, and availability of the affected device.\nFurthermore, the compromise of the management device presents a significant risk to the security and integrity of all downstream serial-attached equipment.\nExploitation requires successful authentication to the terminal or CLI interface, but due to the permissive nature of the authentication process described, an attacker can authenticate as any user to trigger the injection.\nThis represents a severe security risk that necessitates immediate firmware updates or restrictive network access controls.",
  "technicalDetails": "The vulnerability is a classic command injection flaw residing within the system's internal command processing logic. The root cause is the usage of the system() C library function with unsanitized input derived from an undocumented 'mfc eeprom read' command.\nWhen a user invokes this undocumented command, the application fails to perform adequate input validation or filtering on the provided arguments before passing them directly to the underlying system shell.\nThe attack flow begins with the attacker gaining authenticated access to the terminal or CLI interface of the target Lantronix device. While the vulnerability requires authentication, the system's authentication mechanism is reported to be susceptible to unauthorized access, allowing an attacker to authenticate as any user. Once access is obtained, the attacker issues the 'mfc eeprom read' command with a maliciously crafted payload containing shell metacharacters (such as semicolons or backticks).\nBecause the input is processed by the shell, the system executes the attacker-supplied commands with root privileges. This grants the attacker full control over the operating system environment. The payload behavior is limited only by the attacker's intent; they may install persistent backdoors, modify system configurations, exfiltrate sensitive data, or disable security auditing logs.\nThe scope of impact is particularly severe due to the role of these devices as console servers. By gaining root access to the host device, the attacker can intercept, redirect, or disrupt traffic to serial-attached devices managed by the unit, effectively compromising the physical infrastructure connected to the console server. This cross-layer impact facilitates lateral movement within the management network.\nAffected products include Lantronix SLC8000 (pre-v9.7.0.2), EMG8500 and EMG7500 (pre-v9.7.0.1), and all firmware versions of SLB882, SLCx-03, and SLCx-02. The vulnerability is persistent as long as the underlying system binary responsible for the 'mfc eeprom read' call remains unpatched and susceptible to command injection.\nThe lack of sanitization at the command interface layer ensures that any input, regardless of origin, is executed with the privileges of the main process, which in this architecture is identified as the root user."
}