Description

Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-22T16:17:59.303Z",
  "pubdate": "2026-09-22T16:17:59.303Z",
  "executiveSummary": "This vulnerability is a critical command injection flaw affecting multiple Lantronix console management products, specifically the SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 series.\nThe flaw stems from the improper neutralization of user-supplied input within an undocumented 'mfc eeprom write' command. This allows an authenticated attacker to execute arbitrary shell commands with root privileges.\nSuccessful exploitation results in the complete compromise of the device's confidentiality, integrity, and availability. Because these devices typically act as out-of-band management gateways, an attacker gaining root access can pivot to, monitor, or manipulate sensitive serial-attached infrastructure.\nThe vulnerability requires the attacker to authenticate to the device's terminal or CLI interface; however, because the vulnerability allows authentication as any user, it poses an extreme risk to infrastructure security.\nThe issue is resolved for the SLC8000 series in firmware v9.7.0.2 and above, and for the EMG8500/EMG7500 series in firmware v9.7.0.1 and above. The SLB882, SLCx-03, and SLCx-02 models are affected across all firmware versions, with no current patch path provided.",
  "technicalDetails": "The vulnerability resides within the device's command processing logic, specifically associated with an undocumented manufacturing ('mfc') function intended for EEPROM write operations. The underlying defect is a classic command injection vulnerability caused by the direct passing of unsanitized user-supplied parameters into a system() library call.\nThe attack flow begins with an attacker obtaining authenticated access to the device through the terminal or CLI interface. Although the vulnerability requires authentication, the system's access controls allow an attacker to authenticate as any user, effectively bypassing meaningful authorization restrictions.\nOnce authenticated, the attacker invokes the undocumented 'mfc eeprom write' command. The application accepts a parameter intended to define specific data or memory addresses but fails to validate or sanitize the input against shell metacharacters. An attacker can craft a malicious payload containing command delimiters such as semicolon (;), pipe (|), or backticks (`) to terminate the intended system function and append arbitrary commands.\nBecause the underlying application or service responsible for executing the system() call operates with root-level privileges, the injected commands are executed with the same level of authority. This grants the attacker full control over the underlying Linux-based operating system of the Lantronix device.\nThe post-exploitation impact is severe. An attacker can gain persistent access, exfiltrate configuration data, capture traffic passing through the serial ports, or push malicious firmware/configurations to downstream serial-attached devices, such as routers, switches, or servers. The lack of input validation essentially turns a manufacturing utility into a powerful remote code execution vector for any authenticated user.\nAffected products include: Lantronix SLC8000 (pre-v9.7.0.2), EMG8500/EMG7500 (pre-v9.7.0.1), and all firmware versions of SLB882, SLCx-03, and SLCx-02."
}