Lantronix SLC8000 EUVD-2026-84520

Exploitation requires network reachability to the affected Lantronix device's web management portal AND a legitimate user with an active logged-in session, because valid session tokens are generated deterministically from the device model plus the current time at one-second resolution - the attacker must enumerate the small token keyspace while such a session is live. The attacker then sends a crafted URI that abuses file-extension handling in the web server's path routing to defeat the per-session source-IP and User-Agent validation, allowing a token derived from a different source address to be replayed. No credentials are needed (PR:N/unauthenticated), but the active-session requirement (AT:P/UI:A) is the primary limiting factor; a device with no current user sessions offers no valid token to derive. All firmware versions are affected, so version-based mitigation is not available from the provided data.

This is a genuine priority, not a paper tiger. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H with subsequent-system SC:H/SI:H/SA:H, base 8.9) describes a remote, unauthenticated compromise of an out-of-band management appliance with full confidentiality/integrity/availability impact that propagates to attached systems - precisely the class of device attackers target for persistence and lateral movement. The AT:P (attack requirement) and UI:A signals honestly reflect the one real gate: a legitimate user must have an active session so a valid deterministic token exists in the enumerable window. CWE-330 (predictable/insufficiently-random token from model + 1-second-resolution clock) makes token enumeration mathematically trivial, and the path-routing trick neutralizes the source-IP and User-Agent countermeasures, so the residual complexity is low. No EPSS score, CISA KEV entry, or confirmed weaponized exploit code was provided in the input; a detailed third-party research writeup (revrb.net) and the VulnCheck advisory are published, which sharply lowers the barrier to reproduction even though that is distinct from confirmed in-the-wild exploitation. Net: high technical severity on a security-critical device class, gated only by the need to catch an active user session - treat as high priority for patching/mitigation, but exploitation is opportunistic against sessions rather than fully at-will.

While an administrator is logged into a Lantronix SLC/EMG console-server web portal, a remote unauthenticated attacker enumerates the small set of model-and-timestamp-derived session tokens and sends a crafted URI whose file-extension handling bypasses the per-session source-IP and User-Agent checks. Replaying a derived token from their own address, the attacker inherits the logged-in user's elevated privileges and can pivot to serial-attached downstream devices. A detailed public technical writeup (revrb.net 'Lantern') documents the flaw, easing reproduction, though no CISA KEV listing or confirmed active exploitation was provided.