Description

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-22T16:18:01.160Z",
  "pubdate": "2026-09-22T16:18:01.160Z",
  "executiveSummary": "A critical Server-Side Request Forgery (SSRF) vulnerability exists within the WebSSH/WebTelnet listener components of multiple Lantronix console management products.\nThe vulnerability allows an unauthenticated, remote attacker to manipulate the device's internal connection logic, forcing the system to initiate unauthorized SSH connections to arbitrary destination hosts or IP addresses.\nAffected products include Lantronix SLC8000 (pre-v9.7.0.3), EMG8500/EMG7500 (pre-v9.7.0.1), and all firmware versions of the SLB882.\nThis flaw effectively bypasses network segmentation and access control lists (ACLs) by leveraging the trusted status of the management appliance to perform internal network reconnaissance, interact with protected management interfaces, or communicate with external attacker-controlled endpoints.\nSuccessful exploitation requires no prior authentication, posing a severe risk to the integrity and confidentiality of the internal network architecture managed by these devices.",
  "technicalDetails": "The vulnerability resides within the custom 'shellinaboxd' binary responsible for managing WebSSH and WebTelnet terminal sessions. The root cause is the improper handling and insufficient sanitization of the 'rooturl' parameter provided during the initial web connection sequence.\nThe application relies on this user-supplied 'rooturl' parameter to dynamically determine its own operational IP address for the purpose of establishing internal SSH terminal sessions. Because the software fails to validate that the provided 'rooturl' corresponds to the legitimate device address, an attacker can supply a malicious, arbitrary hostname or IP address within the parameter string.\nThe exploitation flow proceeds as follows: First, the attacker initiates a crafted web request to the device's WebSSH/WebTelnet listener. During this handshake or session initialization, the attacker injects the 'rooturl' parameter with the address of a target host, which may reside on the internal network segment or be an external malicious server.\nThe 'shellinaboxd' service consumes the malicious 'rooturl' and incorrectly reconfigures its internal connection routine. Instead of connecting to the intended local service, the appliance initiates an outgoing SSH connection request toward the attacker-specified destination. This behavior forces the appliance to act as a proxy or a pivot point for the attacker's traffic.\nBy manipulating this process, an attacker can bypass traditional perimeter firewalls and segment boundaries. Since the connection originates from the appliance—a device typically deployed with significant internal network visibility—the attacker can perform reconnaissance on sensitive internal systems that do not normally face the external internet. Furthermore, this mechanism can be leveraged to establish command-and-control (C2) communication channels, effectively exfiltrating data or sending instructions to otherwise isolated infrastructure components.\nThe vulnerability affects Lantronix SLC8000 versions prior to v9.7.0.3, EMG8500/EMG7500 versions prior to v9.7.0.1, and the entirety of the SLB882 firmware release history. No user credentials or administrative privileges are required to trigger this request forgery, as the flaw is exposed at the pre-authentication stage of the web interface."
}