Description

Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-22T16:18:01.917Z",
  "pubdate": "2026-09-22T16:18:01.917Z",
  "executiveSummary": "This vulnerability is an authentication bypass and remote code execution flaw residing in the web management portal of multiple Lantronix console managers, including SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02.\nThe vulnerability originates in the upload endpoint, where improper handling of session cookie file paths allows unauthenticated attackers to manipulate file system paths via path traversal.\nBy triggering a path truncation during the construction of the session cookie file path, an attacker can redirect the authentication validation logic to arbitrary files on the local filesystem, such as the user database, effectively bypassing all authentication checks.\nSuccessful exploitation grants an attacker full control over the affected device, resulting in a total compromise of confidentiality, integrity, and availability.\nGiven that these devices function as serial console servers, a compromise facilitates lateral movement into downstream infrastructure, posing a critical security risk to connected serial hardware.\nThis vulnerability does not require prior authentication, and exploitation can be performed remotely over the network.",
  "technicalDetails": "The vulnerability is primarily rooted in an insecure implementation of file path construction within the web configuration server component. The application uses the snprintf function to generate the file path for session cookies; however, it utilizes a fixed-size buffer that is susceptible to truncation when provided with a specific length input.\nThe attack flow initiates when an unauthenticated attacker submits a crafted cookie value designed to exceed the buffer constraints of the path construction mechanism. By carefully choosing the length of this cookie string, the attacker induces path truncation at a specific point in the path string, effectively altering the intended directory structure.\nThis truncation, when combined with path traversal sequences, allows the attacker to manipulate the file path utilized by the authentication validation service. Instead of verifying the session against legitimate session files, the service is redirected to load an arbitrary file from the filesystem. By pointing this mechanism toward the local user database or other critical security configuration files, the application logic incorrectly confirms the session as valid.\nOnce authentication is bypassed, the attacker gains access to the web management portal's functionality, specifically the upload endpoint. Because the application logic fails to properly sanitize or validate file paths during the upload process, the attacker can leverage further path traversal to write arbitrary files to restricted locations on the device filesystem. This capability allows for the placement of malicious binaries or the modification of existing system configuration files to facilitate arbitrary remote code execution.\nThe vulnerable products include Lantronix SLC8000 (versions prior to 9.7.0.5), EMG8500/EMG7500 (versions prior to 9.7.0.1), and all firmware versions of SLB882, SLCx-03, and SLCx-02. The post-exploitation impact is severe, enabling the attacker to gain full administrative control, exfiltrate sensitive configuration data, and potentially bridge the management network to serial-connected downstream devices, thereby escalating the threat to the entire serial-connected environment."
}