Lantronix SLC8000 EUVD-2026-84516

Exploitation requires network reachability to the device's WebSSH/WebTelnet interface served by the custom shellinaboxd listener; no authentication, user interaction, or non-default configuration is needed (the listener is a standard feature of these out-of-band management devices). The specific prerequisite is that the attacker can submit the 'rooturl' parameter to that listener. Limiting factors: impact is confined to coercing outbound Telnet connections (reconnaissance/pivot), not code execution; realistic risk depends on whether the management/console interface is exposed to attacker-controlled network segments, and value derives from the internal endpoints reachable from the device's position.

This is a genuine but bounded risk. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - the SSRF is trivially reachable on the WebSSH/WebTelnet listener. However, technical impact is limited to confidentiality/pivot: the flaw only coerces the device into opening Telnet connections to attacker-chosen hosts (VC:L, VI:N, VA:N), with no code execution, data write, or availability loss. The elevated SC:H (subsequent-system confidentiality) is the reason the score reaches 7.7 - it reflects that the device becomes a pivot into otherwise-inaccessible internal networks. No EPSS score, KEV listing, or weaponized POC is present in the input; VulnCheck reported it and a technical writeup exists (revrb.net), so exploitation is well-understood but not confirmed active in the wild. Net: prioritize patching because it is unauthenticated and these are internet/management-adjacent devices, but this is a pivot/reconnaissance primitive, not a direct RCE - real risk is moderate and scenario-dependent on network exposure of the management interface.

An unauthenticated attacker who can reach the device's WebSSH/WebTelnet interface sends a request to the custom shellinaboxd listener with a modified 'rooturl' parameter pointing at an internal host and port. The device then establishes a Telnet connection to that attacker-specified endpoint, letting the attacker enumerate or interact with internal services normally shielded from the outside. A public technical writeup exists (revrb.net / VulnCheck advisory), but no weaponized exploit is confirmed in the input.