Lantronix SLC8000 EUVD-2026-84517

Exploitation requires an authenticated account holding the specific 'services' permission with access to the device's terminal or CLI interface; the payload is delivered through the 'set nfs download' command's unsanitized parameter, which flows into a system() call executed as root. Affected: Lantronix SLC8000 before v9.7.0.3, EMG8500/EMG7500 before v9.7.0.1, and ALL firmware of SLB882/SLCx-03/SLCx-02 (no fixed build published for the latter three - a hard limiting note for defenders). Limiting factors: the services-permission privilege gate (PR:H) means it is not exploitable by anonymous/unauthenticated attackers or by low-privilege users lacking that role; no user interaction is needed once that privilege is held.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, 9.4) describes network-reachable, low-complexity command injection yielding root and full triad loss on the device plus scope-crossing impact to serial-attached downstream systems. The only real brake is PR:H - the attacker must already hold the 'services' permission and authenticate to the terminal/CLI interface - so this is a privilege-escalation-to-root / lateral-movement primitive rather than an unauthenticated takeover. No EPSS score was provided and the flaw is NOT in CISA KEV, so there is no evidence of active mass exploitation; however, a detailed third-party technical write-up (revrb.net 'revrb-lantern') and a VulnCheck advisory are published, which lowers the bar to weaponization considerably. The key conflicting/missing signals: no explicit POC=YES flag or EPSS value is supplied, so exploitation likelihood must be inferred from the public technical disclosures rather than confirmed telemetry. Because these are out-of-band/console management devices (attractive to attackers as a pivot into managed infrastructure), realistic risk is elevated despite the authentication requirement.

An attacker who has obtained (or been delegated) the 'services' permission authenticates to the SLC/EMG/SLB device's terminal or CLI, then runs the 'set nfs download' command with a shell metacharacter payload in the unsanitized parameter, which is passed to system() and executed as root. This grants full control of the console server and a pivot to any serial-attached downstream equipment. Public technical write-ups (revrb.net and VulnCheck advisory) document the flaw, so working exploit details are effectively available even though no formal POC flag is set.