Description

Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device's filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-22T16:18:02.083Z",
  "pubdate": "2026-09-22T16:18:02.083Z",
  "executiveSummary": "A critical path traversal vulnerability exists within the web management portal upload endpoint of multiple Lantronix device lines, specifically affecting SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 models. The vulnerability allows an authenticated attacker to perform arbitrary file writes to the underlying filesystem, facilitating remote code execution (RCE).\nThe flaw originates from insufficient sanitization of the filename parameter during file upload operations. Specifically, the validation logic fails to adequately handle the sequence of backslash and forward slash characters, enabling directory traversal outside the intended web-accessible directory. Exploitation requires authenticated access to the web management interface. Successful exploitation results in a complete compromise of the device's confidentiality, integrity, and availability, and poses a significant threat to the security of downstream serial-connected infrastructure. Organizations are advised to update affected firmware to the latest available versions or apply network-level access controls to restrict access to the management portal.",
  "technicalDetails": "The vulnerability resides within the web management portal's file upload mechanism. The root cause of this security defect is an inadequate input validation routine designed to prevent path traversal attacks. When a user initiates a file upload, the application processes the provided filename parameter; however, the logic intended to strip directory traversal characters is flawed. Specifically, the validation routine strips backslash characters (\\) but fails to perform subsequent recursive checks or handle combinations of backslashes and forward slashes (/).\nAn authenticated attacker can bypass these insufficient checks by crafting a filename that incorporates both character types. By supplying a filename containing a backslash followed by a forward slash, the application's sanitization routine triggers the removal of the backslash while leaving the forward slash intact. This resulting string allows the attacker to traverse directories outside the designated upload directory. Consequently, the application interprets the malicious filename as a path, permitting the attacker to write arbitrary data to any location on the device's filesystem where the web service process has write permissions.\nThe exploitation flow begins with the attacker authenticating to the web management portal. Once authenticated, the attacker initiates a file upload request, substituting the standard filename with a payload engineered to achieve directory traversal. By targeting executable paths, configuration files, or startup scripts, the attacker can overwrite critical system binaries or inject arbitrary code. Upon the next system execution or service restart, the injected code is executed, granting the attacker Remote Code Execution (RCE) with the privileges of the web management service.\nAffected products include the Lantronix SLC8000 (pre-v9.7.0.5), EMG8500/EMG7500 (pre-v9.7.0.1), and all firmware versions of SLB882, SLCx-03, and SLCx-02. The post-exploitation impact is severe, as it grants full control over the device. Beyond the immediate impact on the affected hardware, the compromise of serial console servers often leads to the lateral movement or control of connected serial devices, which may include critical infrastructure components, networking hardware, or industrial control systems."
}