Description

Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-22T16:18:00.720Z",
  "pubdate": "2026-09-22T16:18:00.720Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the Lantronix SLC8000, EMG8500, EMG7500, SLB882, and SLCx-03/SLCx-02 series devices. The flaw originates from an undocumented 'mfc eeprom' read command that fails to perform adequate bounds checking when processing user input.\nThe vulnerability allows an authenticated attacker to trigger a memory corruption event by providing an oversized input string. Successful exploitation enables the execution of arbitrary code with elevated system privileges, resulting in a total compromise of the device's confidentiality, integrity, and availability. Because these devices manage serial-attached infrastructure, the impact extends beyond the management console to downstream serial-attached hardware.\nThe risk is severe, as it facilitates remote command injection via the terminal or CLI interface. Exploitation requires authenticated access, though the vulnerability permits authentication as any valid user, effectively bypassing standard access controls. Organizations relying on these serial consoles should prioritize patching affected firmware or implementing strict network-level access controls to mitigate unauthorized command execution.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow located in the command processing logic of the Lantronix device firmware. The root cause is the improper handling of input data supplied to an undocumented 'mfc eeprom' read command. When this command is invoked, the system accepts user-provided input and copies it into a statically allocated stack buffer without performing length validation or bounds checking. The lack of constraint on the copy operation allows the input to exceed the intended buffer size, leading to an overflow of adjacent memory on the stack.\nThe attack flow proceeds as follows: First, an attacker gains authenticated access to the device's CLI or terminal interface. Once authenticated, the attacker issues the malformed 'mfc eeprom' read command, injecting a payload designed to overwrite the return address stored on the stack. Because the vulnerable function subsequently passes the overflowed data buffer to a system() call, the attacker can hijack the control flow to execute arbitrary shell commands with the privileges of the management process.\nAffected products include the SLC8000 (pre-v9.7.0.2), EMG8500/EMG7500 (pre-v9.7.0.1), and all versions of the SLB882, SLCx-03, and SLCx-02 units. The exploitation does not require special administrative privileges, as the system accepts standard user authentication to access the CLI interface. By carefully crafting the overflow payload, an attacker can overwrite critical return pointers, redirecting the execution flow to malicious shellcode or leveraging the system() call to invoke arbitrary binaries.\nThe post-exploitation impact is catastrophic. A successful exploit grants the attacker persistent control over the management console, allowing them to intercept serial traffic, reconfigure the device, or pivot into connected downstream networks. Due to the nature of console servers, the integrity of all connected serial devices is also compromised. Given that the system() function executes with elevated system-level permissions, there are no effective internal sandboxing mechanisms to prevent the attacker from achieving full root-equivalent control over the OS environment."
}