Description

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-22T16:18:01.013Z",
  "pubdate": "2026-09-22T16:18:01.013Z",
  "executiveSummary": "A server-side request forgery (SSRF) vulnerability exists within the WebSSH/WebTelnet listener component of Lantronix SLC8000, EMG8500, EMG7500, and SLB882 devices. This vulnerability allows an unauthenticated, remote attacker to manipulate the target connection string used by the device's shellinaboxd service. By providing a specially crafted, overlong username, an attacker triggers a buffer truncation issue within an snprintf call, forcing the device to initiate an outbound SSH connection to an arbitrary, attacker-controlled host. The vulnerability effectively bypasses network segmentation, permitting the attacker to utilize the compromised Lantronix appliance as a proxy or pivot point to interact with internal network resources that are otherwise isolated from the public internet. The risk is critical, as it requires no prior authentication and provides a mechanism for unauthorized network reconnaissance and potential lateral movement within the management infrastructure. Exploitation is achieved by manipulating the input parameters processed by the underlying web-based terminal interface, demonstrating a failure in proper input validation and memory safety during string formatting operations.",
  "technicalDetails": "The vulnerability resides in the custom build of the shellinaboxd daemon, which handles WebSSH and WebTelnet listener requests. The root cause of this SSRF is an improper implementation of string formatting using the snprintf function. When the WebSSH service attempts to construct the target SSH connection string, it incorporates user-supplied input—specifically the username—directly into the connection command. Due to inadequate bounds checking or buffer length management, supplying an excessively long username string triggers a truncation event during the snprintf execution.\nThe exploitation flow proceeds as follows: First, the attacker initiates a request to the device's WebSSH/WebTelnet interface. Second, the attacker crafts a malicious input string for the username field that is designed to overflow the target buffer allocated for the full connection string. Third, the snprintf function performs the concatenation; the resulting truncation causes the intended IP address suffix of the management device to be sliced, effectively altering the destination argument of the SSH client execution. Fourth, the shellinaboxd process, believing it is connecting to a legitimate internal target, initiates an outbound SSH connection to the now-modified, attacker-controlled endpoint.\nThis behavior allows an attacker to direct the device to perform a connection to any reachable IP address. Because the device operates within the internal network management segment, this SSRF acts as a bridge, allowing the attacker to bypass firewall rules and access internal network endpoints that are not externally exposed. The impact of this vulnerability is significant, as it enables unauthorized device-to-host communication, facilitating network enumeration, credential harvesting, or exploitation of internal services reachable from the Lantronix device. The flaw is present in all firmware versions of the SLB882, as well as SLC8000 versions prior to v9.7.0.3 and EMG8500/EMG7500 versions prior to v9.7.0.1. No authentication or privileged access is required to initiate the attack, making it accessible to any actor capable of reaching the device's web interface."
}