Lantronix SLC8000 EUVD-2026-84506

Requires an authenticated session on the device's terminal or CLI interface - the description states an attacker can authenticate 'as any user,' so only low-privilege credentials are needed (matching PR:L), not administrative rights. Exploitation targets the undocumented 'mfc eeprom read' command, whose parameter is passed unsanitized to system(); no user interaction is required. Limiting factors: the CLI/management interface must be network-reachable to the attacker (these are out-of-band management devices typically on management/serial-console networks), valid credentials of any privilege level are required, and knowledge of the undocumented command is needed (now lowered by the public revrb.net writeup). SLB882/SLCx-03/SLCx-02 have no available fix, so those deployments cannot be remediated by patching.

This is a genuine high-priority vulnerability, not merely a high-CVSS-on-paper issue, though its exploitability is gated by authentication. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H with subsequent-system impact SC:H/SI:H/SA:H) describes network-reachable, low-complexity command injection requiring only low-privilege authentication, yielding root-level command execution - the SC/SI/SA:H subsequent-system metrics correctly reflect that a compromised out-of-band console server pivots to downstream serial-attached devices (the very equipment these boxes exist to manage). The score of 9.4 is well-justified. However, the real-world urgency signals are mixed: no EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is 'no public exploit identified at time of analysis' despite the high technical severity. The command is described as 'undocumented,' which raises the practical bar to discovery but does not eliminate it now that a public writeup (revrb.net) exists. Net: treat as high-priority for patching on any exposed device, but active mass exploitation is not indicated - risk is targeted rather than widespread. Note the vector is confirmed by the vendor/VulnCheck but no independent third-party CVSS was supplied for cross-check.

An attacker with any valid low-privilege account on the SLC8000/EMG/SLB882/SLCx terminal or CLI interface invokes the undocumented 'mfc eeprom read' command and appends shell metacharacters to its parameter, which is passed unsanitized to a system() call running as root. This grants full root command execution on the console server, from which the attacker can tamper with or eavesdrop on downstream serial-attached devices. No public exploit code is identified, but a technical writeup describing the flaw is publicly available.