Lantronix SLC8000 EUVD-2026-84511

Requires a valid (any) low-privilege account and network reachability to the device's terminal or CLI management interface, after which the attacker invokes the undocumented 'mfc eeprom read' command with oversized input - this is not exposed in default operation but is present in affected firmware. Limiting factors: authentication is mandatory (PR:L), so the management interface must be reachable and the attacker must hold or obtain any credential; exposure is heightened where console servers use shared/default credentials or are reachable from adjacent management networks. Affected firmware: SLC8000 before 9.7.0.2, EMG8500/EMG7500 before 9.7.0.1, and ALL versions of SLB882/SLCx-03/SLCx-02 (no patch available for the latter three).

This is a genuine high-priority vulnerability by technical severity, though real-world urgency is tempered by product niche and an authentication gate. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, score 9.4) describes a network-reachable, low-complexity attack requiring only low-privilege authentication (PR:L) and no user interaction, yielding full confidentiality/integrity/availability loss on the device plus subsequent-system impact (SC/SI/SA:H) to downstream serial-attached equipment. The stack overflow (CWE-121) feeds unbounded input to a system() call, making arbitrary code execution highly plausible. Exploitation status: no public exploit identified at time of analysis - a technical writeup exists (revrb.net) and VulnCheck published an advisory, but neither is characterized as a weaponized POC in the provided data. No EPSS score and no CISA KEV listing are provided, so there is no evidence of active exploitation; this reads as a credible but not yet mass-exploited issue. The chief conflicting/limiting signal is the PR:L authentication requirement: the description notes an attacker can authenticate 'as any user,' which - combined with out-of-band management devices that are sometimes weakly credentialed or shared - makes the low-privilege bar realistically clearable in poorly-managed deployments. Patch availability for the primary models is confirmed, but the SLB882/SLCx-03/SLCx-02 lines have no fix in any version, leaving those permanently exposed.

An attacker with any valid low-privilege account reaches the device's terminal or CLI interface over the network and issues the undocumented 'mfc eeprom read' command with an oversized argument, overflowing a bounded stack buffer that is then passed to system(). This yields arbitrary command execution on the console server and can cascade to the serial-attached devices it manages. No public exploit code is identified, though a vendor/VulnCheck advisory and third-party writeup describe the flaw.