Lantronix SLC8000 EUVD-2026-84512

Exploitation requires the attacker to authenticate as any user (including low-privilege) to the device's terminal or CLI management interface, then invoke the undocumented 'mfc eeprom write' command with input larger than the fixed stack buffer. Limiting factors: authentication is required (PR:L), so exposure hinges on the management interface being network-reachable and on credential strength; the command is undocumented, so the attacker must know it exists (the revrb.net and VulnCheck write-ups now disclose it). Affected: SLC8000 before 9.7.0.2, EMG8500/EMG7500 before 9.7.0.1, and all firmware of SLB882/SLCx-03/SLCx-02 (no patch exists for the latter three). Successful exploitation impacts both the device and downstream serial-attached equipment.

This is a genuine high-priority issue where nearly all signals align toward serious risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) describes low-complexity, network-reachable, authenticated code execution that also compromises downstream serial-attached systems - earning a well-founded 9.4. CWE-121 stack overflow flowing into a system() call is a classic reliable-RCE primitive, and a patch is available from Lantronix, all of which raise the credibility of the technical severity. Countervailing signals temper the urgency: EPSS is not provided, there is no CISA KEV listing, and no public POC is referenced (only a VulnCheck advisory and a revrb.net write-up), so there is no evidence of active or automated exploitation - this reads as a serious-but-not-yet-weaponized flaw. The main limiter is PR:L: an attacker must first authenticate to the terminal or CLI, so exposure depends heavily on whether the management interface is network-reachable and how credential hygiene is managed. Note the SC/SI/SA:H subsequent-system impact is the reason my independent CVSS 3.1 mapping uses scope-change (S:C), yielding ~9.9. A caveat for defenders: SLB882, SLCx-03, and SLCx-02 have NO fix across all firmware versions, so for those models this remains an unpatchable exposure requiring compensating controls.

An attacker who can reach the console-server's terminal or CLI management interface authenticates as any user (even a low-privilege account) and invokes the undocumented 'mfc eeprom write' command with an oversized argument, overflowing a bounded stack buffer that is subsequently passed to system(). This yields arbitrary code execution on the device and can cascade to the serial-attached equipment it manages. No public exploit code is identified at time of analysis, but a VulnCheck advisory and a revrb.net technical write-up describe the mechanism in detail.