Description

Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-22T16:18:00.863Z",
  "pubdate": "2026-09-22T16:18:00.863Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in multiple Lantronix console management products, specifically affecting the SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 models.\nThe vulnerability resides within an undocumented 'mfc eeprom write' command that lacks adequate input validation, allowing authenticated attackers to trigger a memory corruption condition.\nBy supplying an oversized input, an authenticated attacker can overwrite the stack memory, potentially leading to arbitrary code execution with the privileges of the affected service.\nThis flaw presents a severe risk to device integrity, as successful exploitation enables full compromise of the affected device, resulting in a loss of confidentiality, integrity, and availability.\nFurthermore, because these devices manage serial-attached infrastructure, the compromise of the management appliance can facilitate lateral movement and control over downstream systems.\nExploitation requires successful authentication to the terminal or CLI interface, but the vulnerability is exacerbated by the ability for any user to initiate the malicious command sequence.",
  "technicalDetails": "The root cause of this vulnerability is a stack-based buffer overflow located within the handling logic of an undocumented command, identified as the 'mfc eeprom write' command.\nDuring the processing of this command, the system performs a memory operation that copies user-supplied input into a fixed-length stack buffer without implementing necessary bounds checking.\nFollowing this copy operation, the contents of the buffer—potentially corrupted by an attacker—are passed as an argument to a system() function call.\nThe exploitation flow initiates when an attacker authenticates to the target device via the CLI or terminal interface. Once authenticated, the attacker sends a specially crafted, oversized payload designed to exceed the allocated stack buffer size.\nThe lack of validation allows the input to overflow the buffer, overwriting adjacent memory regions on the stack, including the saved return address or critical function pointers.\nWhen the program execution reaches the modified return address or a corrupted function pointer, control flow is hijacked. The subsequent call to system() allows the attacker to execute arbitrary shell commands with the privileges assigned to the management process.\nAffected firmware versions include Lantronix SLC8000 (versions prior to v9.7.0.2), EMG8500/EMG7500 (versions prior to v9.7.0.1), and all versions of the SLB882, SLCx-03, and SLCx-02 lines.\nBecause the vulnerability facilitates arbitrary code execution, an attacker can achieve a complete takeover of the console server. This impact extends beyond the management appliance itself; attackers can use the device as a pivot point to interact with, reconfigure, or disrupt the downstream serial-attached assets managed by the device.\nThe lack of secure coding practices in the command processing pipeline, combined with the usage of system() with untrusted user input, constitutes a classic buffer overflow scenario that bypasses typical command sanitization routines."
}