EUVD-2026-84509
GHSA-6665-q8xg-hw4c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to terminal/CLI with 'services' permission
-
DeliveryIssue `set cifs password` with shell metacharacters
-
ExploitUnsanitized input reaches system() call
-
ExecutionExecute arbitrary commands as root
-
ImpactCompromise device and pivot to serial-attached devices
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with the 'services' permission on the affected Lantronix device, reachable via the terminal or CLI management interface; the attacker then supplies shell metacharacters through the |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) rates this 9.4 Critical, driven by root-level shell execution and cascading impact onto downstream serial-attached devices. However, PR:H is the decisive limiter: exploitation requires an authenticated account holding the specific 'services' permission, so this is a privilege-escalation/lateral-movement primitive for an already-trusted operator rather than an internet-facing pre-auth RCE. No EPSS score, KEV listing, or POC is present in the provided intelligence, so there is no signal of active or automated exploitation - this is a 'high-CVSS, real-but-gated' issue rather than a mass-exploitation emergency. The signals are internally consistent (network-reachable management CLI, low complexity once authenticated), but the practical risk hinges entirely on how tightly the 'services' role and management-plane network access are controlled. Note the incomplete patch story: SLB882, SLCx-03, and SLCx-02 have NO fix across all firmware versions, which elevates residual risk for those specific models. |
| Exploit ScenarioDerived | An attacker who has obtained (or been legitimately granted) a Lantronix account with the 'services' permission logs into the device's terminal or CLI interface and issues the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Authenticated command injection in Lantronix console/out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) lets an attacker who already holds the 'services' permission reach the terminal or CLI interface and run arbitrary shell commands as root via a crafted set cifs password argument, resulting in complete loss of confidentiality, integrity and availability on the device and possible cascading impact on serial-attached downstream equipment. CVSS 4.0 rates this 9.4 (Critical) on an AV:N/AC:L/PR:H/UI:N vector with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) agrees on severity. The vendor has shipped patched firmware for SLC8000 (9.7.0.2) and for EMG8500/EMG7500 (9.7.0.1), while SLB882, SLCx-03 and SLCx-02 have no fix identified in any firmware version; no public exploit code was identified at time of analysis, and CISA KEV does not list this issue.
RemediationAI
Vendor-released patch: upgrade Lantronix SLC8000 to firmware v9.7.0.2 (image 9.7.0.2R1 from https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/) and EMG8500/EMG7500 to firmware v9.7.0.1 (image 9.7.0.1R2 from https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ and https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/); for SLB882, SLCx-03 and SLCx-02, no vendor-released patch was identified at time of analysis, so those deployments must rely on compensating controls until a fix ships. Specific controls, with their trade-offs: (1) immediately audit and remove the 'services' permission from every account that does not strictly require it, since the privilege is the sole gate on exploitation - this may break automation or delegated console administration; (2) restrict management CLI and terminal access to a dedicated, segmented management VLAN or jump host with firewall ACLs so an attacker cannot reach the vulnerable interface from user or internet-facing networks - this requires network re-architecture and can complicate remote support if not paired with an out-of-band path; (3) disable or leave unconfigured CIFS/SMB-backed features and avoid issuing set cifs password on unpatched units, blocking the vulnerable command path at the cost of losing CIFS-based file/log export; (4) enable and forward authentication and CLI command logging to a SIEM, alerting on any use of set cifs password or shell metacharacters in parameters, which detects but does not prevent exploitation; and (5) for SLB882/SLCx-03/SLCx-02 specifically, treat the devices as untrusted, isolate their serial-attached downstream equipment with separate credentials and monitoring, and plan hardware replacement or vendor escalation since no firmware fix is available. Apply the vendor firmware updates first on internet- or broadly reachable units and validate that the fixed image is the one documented in the VulnCheck advisory (https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-set-cifs-password).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), the classic command-injection class: the appliance's CLI handler for the set cifs password command concatenates the user-supplied parameter into a command string that is handed to a C library system() call, so shell metacharacters embedded in the password argument are interpreted by the underlying shell rather than treated as opaque data. Because the CLI process runs with elevated privileges, the injected payload executes as root on the appliance's embedded Linux firmware, and the CPE data confirms the affected product families are the Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 out-of-band console/terminal servers (cpe:2.3:a:lantronix:*). These devices sit at the management edge of network infrastructure, proxying serial console sessions to routers, switches and OT gear, so root compromise of the console server itself yields a pivot to everything wired to its serial ports. The prerequisite is a legitimate account carrying the 'services' permission, which is an administrative/privileged role rather than a default low-privilege account (reflected as PR:H in both the CVSS 4.0 vector and our CVSS 3.1 reassessment) and the attacker must be able to reach the terminal or CLI management interface, typically exposed only on a management network.
Know when Slc8000 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable CLI with low complexity but PR:H for the required 'services' permission; S:C because root RCE reaches downstream serial-attached devices beyond the security scope, with full C/I/A loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Executive ViewAI
Lantronix console and out-of-band management appliances - SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 - contain a critical authenticated command-injection flaw that grants root-level control of the device to anyone already holding the 'services' permission. Because these appliances are the trusted recovery and management path into serial-attached network, industrial and facility equipment, a compromised unit can be used to disable monitoring, alter configurations or cut off management access to the systems behind it. Leadership should treat this as an out-of-band continuity risk: remediation is available for only three of the six affected platforms, leaving the remaining models exposed for the foreseeable future.
Apply vendor patch where available - SLC8000 (firmware 9.7.0.2) and EMG8500/EMG7500 (firmware 9.7.0.1). For SLB882, SLCx-03 and SLCx-02 no vendor-released patch has been identified at time of analysis: interim mitigations are to restrict management-interface access to a dedicated management VLAN or hardened jump host, enforce least privilege and minimize the number of accounts holding the 'services' permission, rotate credentials and keys for those accounts, enable session logging and alerting on CLI/terminal activity, and segment serial-attached downstream equipment so it cannot be reached or reconfigured from a compromised appliance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Unauthenticated remote attackers can completely compromise the web management portal of Lantronix console servers, readi
Authenticated command injection in Lantronix out-of-band console managers (SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, SL
Authenticated OS command injection in Lantronix out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SL
Authenticated command injection in Lantronix SLC8000 console servers (before firmware v9.7.0.3), EMG8500/EMG7500 (before
Root-level command injection in Lantronix console servers - SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 - let
Authenticated file-write path traversal in the Lantronix web management portal lets a logged-in attacker upload a crafte
An authenticated stack-based buffer overflow in Lantronix SLC8000, EMG8500/EMG7500, SLB882 and SLCx-02/SLCx-03 console m
Authenticated remote code execution in Lantronix SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, and SLCx-02 console servers
Predictable session-token generation in the web management portal of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-0
Server-side request forgery in the WebSSH/WebTelnet listener of Lantronix SLC8000 (before firmware 9.7.0.3), EMG8500/EMG
Unauthenticated server-side request forgery in the Lantronix SLC8000, EMG8500/EMG7500 and SLB882 console servers lets an
Unauthenticated server-side request forgery in the WebSSH/WebTelnet web terminal listener of Lantronix SLC8000 console s
Exploit-DB