Description

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set script schedule command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-22T16:18:01.607Z",
  "pubdate": "2026-09-22T16:18:01.607Z",
  "executiveSummary": "This vulnerability is a command injection flaw identified in multiple Lantronix console management products, specifically affecting the SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 units.\nThe vulnerability originates from the improper sanitization of user-supplied input passed to a system() function call within the 'set script schedule' command.\nSuccessful exploitation allows an authenticated attacker possessing the 'services' permission level to execute arbitrary shell commands with root-level privileges on the underlying operating system.\nThe impact includes a total loss of confidentiality, integrity, and availability (CIA) of the affected device, potentially leading to unauthorized control over downstream serial-attached infrastructure.\nThe risk is severe as it grants an attacker complete system compromise, enabling persistent access, data exfiltration, and lateral movement within the network.\nExploitation requires valid user credentials with specific service-level permissions, limiting the attack surface to authenticated users, though the internal scope of impact remains critical.",
  "technicalDetails": "The vulnerability resides in the command processing logic associated with the 'set script schedule' functionality found in the terminal and CLI interfaces of the affected Lantronix hardware.\nThe root cause is an improper neutralization of special elements used in an OS command (CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection').\nWhen an authenticated user with 'services' permissions invokes the 'set script schedule' command, the input parameters provided are not adequately validated or sanitized before being passed to a system() call execution environment.\nThe system() function call executes the provided input directly within the shell context of the appliance, which operates with root-level process privileges.\nAn attacker can leverage this injection point by appending shell metacharacters (such as ';', '&', or '|') to the parameter field, allowing the injection of arbitrary, unauthorized commands.\nThe attack flow follows a sequential path: First, the attacker authenticates to the device via the terminal or CLI using valid credentials that possess the 'services' privilege level. Second, the attacker interacts with the 'set script schedule' command, inserting a crafted payload into the input string designed to terminate the intended command and execute a secondary, malicious shell command.\nUpon execution, the underlying shell processes the injected payload with root authority. This allows the attacker to manipulate system configurations, modify or delete critical log files, establish persistent backdoors, or pivot into connected serial devices managed by the console server.\nAffected firmware versions include: Lantronix SLC8000 (versions prior to 9.7.0.3), EMG8500/EMG7500 (versions prior to 9.7.0.1), and all firmware versions of SLB882, SLCx-03, and SLCx-02.\nPost-exploitation, the device is fully compromised. Because the system runs commands as root, the attacker effectively gains full control over the appliance's hardware resources, networking stack, and serial port access, creating a significant security risk for the entire managed environment."
}