Description

Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-22T16:18:00.570Z",
  "pubdate": "2026-09-22T16:18:00.570Z",
  "executiveSummary": "This vulnerability is a critical command injection flaw affecting multiple Lantronix infrastructure management devices, including SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 series.\nThe flaw stems from improper sanitization of user-supplied input within the 'set cifs password' command, which triggers a vulnerable system() call execution.\nAn authenticated attacker possessing 'services' level permissions can leverage this vulnerability to execute arbitrary shell commands with root-level privileges on the underlying operating system.\nSuccessful exploitation results in a complete compromise of system confidentiality, integrity, and availability. Furthermore, because these devices manage downstream serial-attached equipment, the impact can extend beyond the host device to managed infrastructure.\nThe vulnerability requires prior authentication, making the 'services' permission a critical boundary for potential attackers. Given the high privilege level attained (root), this flaw represents a severe risk to operational continuity and network security posture for environments relying on these Lantronix devices.",
  "technicalDetails": "The vulnerability resides in the command processing logic handling the 'set cifs password' function within the device interface. The root cause is the insecure implementation of a system() call that processes unsanitized input directly from the user-provided password parameter.\nIn the affected firmware versions, the application fails to perform adequate input validation or character filtering before passing the provided string to the underlying shell environment. Because the command is executed with root privileges, any command injected into the input string will be interpreted and executed by the system shell with the same elevated context.\nAffected products include the SLC8000 (pre-v9.7.0.2), EMG8500 and EMG7500 (pre-v9.7.0.1), and all versions of the SLB882, SLCx-03, and SLCx-02 lines.\nThe exploitation flow begins with the attacker gaining authenticated access to the device's terminal or CLI interface with at least 'services' level privileges. Once authenticated, the attacker invokes the 'set cifs password' command, substituting the legitimate password string with a specially crafted payload containing shell metacharacters (e.g., semicolon, backticks, or pipe symbols) followed by arbitrary malicious commands. Upon submission, the vulnerable system() function executes the concatenated command string, facilitating unauthorized command execution.\nThe resulting impact includes full system takeover. Because these devices are typically used for console access and management of network infrastructure, an attacker can manipulate configurations, exfiltrate sensitive data, or pivot to downstream serial-attached assets connected to the Lantronix device. This allows for lateral movement within the network or disruption of serial-attached services, potentially compromising the entire management plane.\nThe lack of sanitization allows the payload to bypass expected input constraints, transforming a standard configuration update into a remote code execution vector. As the execution context is 'root', the operating system’s security controls and file system permissions are effectively nullified, enabling the attacker to install persistence mechanisms, modify device firmware settings, or disable security auditing logs."
}