Lantronix SLC8000 CVE-2026-80156

Requires an authenticated session on the Lantronix web management portal (PR:H) reachable over the network; the specific trigger is the upload endpoint's filename validation, which strips backslash characters but then fails to check for forward slashes, so a filename containing BOTH characters escapes the intended upload directory and writes to any writable filesystem path. No user interaction is needed beyond the attacker's own authenticated request. Limiting factors: management portal must be network-accessible to the attacker and valid credentials (or credential compromise) are required - devices with the portal restricted to isolated management networks and strong admin credentials are substantially less exposed. Affected: SLC8000 before v9.7.0.5, EMG8500/EMG7500 before v9.7.0.1, and all firmware of SLB882/SLCx-03/SLCx-02 (no listed fix).

This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, score 9.4) describes a network-reachable, low-complexity path-traversal-to-arbitrary-file-write that yields RCE on out-of-band console servers - devices that by design manage other equipment, so the SC/SI/SA:H (downstream serial-connected devices) is credible rather than inflated. The one real gate is PR:H: exploitation requires an authenticated session on the web management portal, which meaningfully lowers mass-exploitation likelihood versus an unauthenticated flaw. No EPSS score, no CISA KEV listing, and no explicitly-flagged public exploit code are provided, so current status is 'no public exploit identified at time of analysis' - however, two detailed technical writeups (VulnCheck advisory and the revrb.net 'revrb-lantern' post) publicly document the exact validation-bypass mechanism (backslash stripping without a subsequent forward-slash check), which substantially lowers the barrier to weaponization even though no packaged PoC is confirmed. Net: elevated risk for exposed/administratively-accessible Lantronix OOB devices, tempered by the authentication requirement and absence of confirmed in-the-wild use.

An attacker who has (or has obtained via weak/default/reused credentials) an authenticated session to the Lantronix web management portal submits an upload whose filename contains both a backslash and a forward slash; the validation strips the backslash but fails to re-check for the forward slash, letting the file be written outside the intended directory to any writable path, which is then leveraged for code execution. Public technical advisories from VulnCheck and revrb.net document the precise bypass, so reliable exploit development is straightforward even though no turnkey PoC is confirmed. Because these are out-of-band console servers, successful RCE can pivot to the serial-connected downstream infrastructure they manage.