Lantronix SLC8000 CVE-2026-80152

Exploitation requires an authenticated account holding the 'services' permission on the Lantronix device, and access to the terminal or CLI management interface. The specific trigger is the 'set script schedule' command, whose parameter is passed unsanitized to a system() call - so the device must expose its management/CLI plane to the attacker and the attacker must possess (or obtain) 'services'-role credentials. No user interaction and no non-default feature toggle is needed beyond having that permission. Limiting factors: PR:H (privileged role required) and the product's management-network exposure - devices whose CLI/terminal interface is restricted to a trusted OOB network sharply reduce reachability. SLB882/SLCx-03/SLCx-02 are vulnerable in all firmware versions (no fixed build), raising residual risk for those models.

This is a genuine high priority within its deployment niche. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, all impacts High, plus subsequent-system SC:H/SI:H/SA:H) describes network-reachable, low-complexity command injection yielding root, with a scope change reflecting compromise of downstream serial-attached devices - exactly the blast radius that makes out-of-band console servers attractive targets. The one meaningful limiter is PR:H: the attacker must already hold the 'services' permission on the device, so this is a privilege-escalation-to-root / lateral-pivot primitive for an authenticated operator or a stolen/weak credential, not a fully unauthenticated internet worm. No EPSS score was supplied and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; however, VulnCheck (the reporter) and a revrb.net writeup publish technical detail on the set-script-schedule sink, which materially lowers the bar to weaponization even though no packaged exploit code is confirmed. Net: high technical severity, real-world urgency scaled down by the required authenticated 'services' role and the product's niche footprint - patch promptly on exposed/management-plane devices, especially all-versions-vulnerable SLB882/SLCx-03/SLCx-02.

An attacker who has obtained an account with the 'services' permission (via credential theft, reuse, or a low-privileged insider) authenticates to the device's terminal or CLI interface and issues a 'set script schedule' command containing shell metacharacters in the unsanitized parameter. Because that input is passed directly to system(), the injected commands run as root, giving full device takeover and a pivot onto the serial-attached equipment the console server manages. No packaged POC is confirmed, but VulnCheck and a public revrb.net writeup describe the vulnerable code path.