Lantronix SLC8000 EUVD-2026-84507

Requires an authenticated session on the device's terminal or CLI/console interface (PR:L - any user account suffices, no admin needed) and network reachability to that management interface. The specific trigger is the undocumented 'mfc eeprom write' command, whose parameter is passed unsanitized to a system() call; injecting shell metacharacters into that parameter yields root command execution. Limiting factors: valid credentials are needed first, exploitation is confined to devices whose CLI/terminal is reachable by the attacker, and SLC8000/EMG models before the fix firmware are vulnerable while patched builds (9.7.0.2R1 / 9.7.0.1R2) close it - but SLB882, SLCx-03, and SLCx-02 have no fix in any version.

This is a genuinely high-priority technical vulnerability but with real-world exposure gated by prerequisites. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H = 9.4) is consistent with the description: unsanitized user input reaching a system() call yields arbitrary command execution as root (CWE-78), and the subsequent-system High metrics (SC:H/SI:H/SA:H) reflect that these are out-of-band console servers whose compromise pivots to downstream serial-attached managed devices. The key mitigating signal is PR:L - the CVSS vector confirms authentication is required (attackers must first log in to the terminal/CLI interface), so this is not a drive-by remote unauthenticated RCE. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation; a technical writeup exists (revrb.net) alongside the VulnCheck advisory, which raises the odds of eventual exploit development but is not itself weaponized exploit code. Net: treat as high-priority to patch on internet- or management-network-exposed devices, but the required authenticated foothold and niche deployment footprint make widespread automated exploitation unlikely versus targeted attacks against exposed OOB infrastructure.

An attacker with any valid low-privilege account on the device's terminal or CLI interface (or one obtained via weak/default credentials) invokes the undocumented 'mfc eeprom write' command and appends shell metacharacters to its parameter, which is passed unsanitized to system(). The injected commands run as root, giving full device takeover and a pivot point onto serial-attached equipment. No public POC is identified at time of analysis, though a technical writeup (revrb.net) and the VulnCheck advisory describe the flaw.