Description

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set nfs download command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-22T16:18:01.460Z",
  "pubdate": "2026-09-22T16:18:01.460Z",
  "executiveSummary": "A critical command injection vulnerability exists within multiple Lantronix console management products, including the SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 series. The flaw arises due to the improper sanitization of user-supplied input provided to the 'set nfs download' command. This vulnerability allows an authenticated attacker possessing 'services' level permissions to execute arbitrary shell commands with root privileges.\nThe impact of this vulnerability is severe, as it grants an attacker complete control over the device. Successful exploitation leads to a total compromise of system confidentiality, integrity, and availability. Furthermore, because these devices manage serial-attached infrastructure, a compromise could facilitate lateral movement or the disruption of downstream critical systems. Exploitation requires the attacker to have valid credentials with specific service-level access, which can be achieved through the device's terminal or CLI interface. Organizations utilizing affected hardware are urged to apply vendor-supplied firmware updates immediately to remediate the risk of remote code execution.",
  "technicalDetails": "The vulnerability is a classic command injection flaw residing in the command-line interface (CLI) processing logic of the affected Lantronix firmware. The specific root cause is the unsafe handling of parameters passed to the 'set nfs download' command. When this command is invoked, the application fails to validate or sanitize the input strings before passing them directly to a system() function call within the underlying OS shell.\nExploitation is feasible by an attacker who has successfully authenticated to the target device with 'services' permission level. An attacker can craft a malicious input string designed to terminate the intended command and append arbitrary shell commands. Because the application executes the resulting string with root-level privileges, the injected commands inherit the highest level of system authority. The attack flow proceeds as follows: First, the attacker establishes a session via the terminal or CLI interface. Second, the attacker interacts with the 'set nfs download' configuration module. Third, the attacker inputs a specially crafted string containing shell metacharacters (e.g., semicolons, backticks, or logical operators) followed by the desired malicious payload. The system process then interprets the entire string as a sequence of shell instructions, resulting in the execution of the injected code.\nThe scope of affected firmware includes Lantronix SLC8000 (pre-v9.7.0.3), EMG8500 and EMG7500 (pre-v9.7.0.1), and all firmware versions of the SLB882, SLCx-03, and SLCx-02 devices. The vulnerability does not require complex heap spraying or memory corruption techniques; it is a straightforward injection vector facilitated by insufficient input validation. Post-exploitation, the attacker gains full persistence and control over the device's operating environment. This includes the ability to exfiltrate sensitive configuration data, modify system binaries, disable security logging, or leverage the device as a pivot point to attack downstream serial-attached equipment. The lack of input normalization at the interface layer permits an attacker to bypass intended operational constraints, effectively circumventing the Principle of Least Privilege."
}