Lantronix SLC8000 CVE-2026-80148

Exploitation requires network reachability to the custom shellinaboxd WebSSH/WebTelnet listener on a Lantronix SLC8000 (before v9.7.0.3), EMG8500/EMG7500 (before v9.7.0.1), or any firmware version of SLB882; no authentication, credentials, or user interaction are needed (PR:N/UI:N). The concrete trigger is supplying an overlong username so the snprintf building the SSH target truncates the device IP suffix, redirecting the outbound SSH connection. Limiting factors: the WebSSH/WebTelnet listener must be exposed and reachable from the attacker, the attacker must control or designate the redirected endpoint, and the impact is blind SSRF (connection establishment/enumeration) rather than direct read of the device - usefulness scales with what internal hosts the device can route to. SLB882 has no fixed firmware, so it can only be mitigated by restricting access to the listener.

The CVSS 4.0 base score is 7.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N - remote, unauthenticated, low-complexity, no user interaction. The severity is driven almost entirely by SC:H (subsequent-system confidentiality), reflecting the SSRF pivot into otherwise-unreachable internal networks; direct impact on the device itself is limited (VC:L, no integrity or availability impact). This is a blind SSRF that establishes outbound SSH connections rather than a code-execution or data-exfiltration primitive, so real-world impact depends on what internal services the device can reach. No EPSS score, no CISA KEV listing, and no confirmed public exploit code are present in the input, so there is no evidence of active exploitation - the ability to reach internal-only endpoints from an internet-exposed out-of-band management appliance still makes this an attractive foothold/reconnaissance capability. A VulnCheck advisory and a third-party research writeup (revrb.net) exist and describe the truncation mechanism in detail, which lowers the barrier to weaponization even though neither is flagged as a formal POC. Note the vendor's SC:H rating is somewhat generous for a blind, connection-only SSRF; I would rate subsequent-system confidentiality closer to SC:L (see assessed vectors). Verdict: a credible, patch-now priority for internet- or DMZ-exposed devices given unauthenticated network reach, but not a mass-exploitation emergency absent KEV/EPSS signals.

An unauthenticated attacker who can reach the WebSSH/WebTelnet listener submits a login request with a deliberately overlong username, causing the shellinaboxd snprintf that builds the SSH target string to truncate the intended device-IP suffix and instead point at an attacker-chosen host. The Lantronix appliance then opens an SSH connection to that arbitrary internal endpoint, letting the attacker enumerate or interact with services normally shielded behind the device. A detailed technical writeup exists (revrb.net / VulnCheck advisory) but no packaged exploit code is confirmed in the input.