Lantronix SLC8000 CVE-2026-80149

Exploitable when the WebSSH/WebTelnet listener (custom shellinaboxd) is reachable and the attacker can supply the rooturl parameter over the web connection - no authentication, user interaction, or special configuration is required (PR:N/UI:N). The limiting factors are network reachability of the device's web listener and, critically, the value of the internal network the device fronts: because SLC8000/EMG/SLB console servers are typically deployed on out-of-band management segments, exploitation requires the attacker to first reach that interface. SLB882 is affected in all firmware versions with no fixed release listed, so those devices cannot be remediated by patching; SLC8000 must be at v9.7.0.3+ and EMG8500/EMG7500 at v9.7.0.1+ to be fixed.

This is a genuine but bounded-impact issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - the most attacker-favorable access profile. The elevated 7.7 score is driven almost entirely by SC:H (subsequent-system confidentiality high): the flaw itself only manipulates the device's outbound SSH target, but the consequence is a pivot that exposes otherwise-unreachable internal network endpoints. Note the vulnerable-system impacts are modest (VC:L/VI:N/VA:N) - the device is not itself compromised; it is abused as an SSRF relay. No EPSS score, no CISA KEV listing, and no confirmed public exploit code are present in the input, so there is no evidence of active exploitation; the risk is potential, not demonstrated. Two independent references (a VulnCheck advisory and a revrb.net technical write-up) describe the mechanism in detail, which raises the likelihood that a working exploit could be reproduced quickly even though none is explicitly published. The affected devices are out-of-band management appliances, which by design sit on sensitive management networks - this amplifies the practical value of an SSRF pivot beyond what the raw score suggests, but is offset by the relatively niche deployment footprint.

An unauthenticated attacker who can reach a Lantronix console server's web interface sends a WebSSH/WebTelnet request with a modified rooturl parameter, causing the custom shellinaboxd to open an SSH connection to an attacker-chosen host or IP instead of its own address. By varying the target, the attacker maps and probes internal hosts and services that are firewalled off from the outside. A detailed technical write-up (revrb.net) and a VulnCheck advisory document the technique, though no packaged public exploit is identified in the available data.