Lantronix SLC8000 EUVD-2026-84521

No special conditions beyond network reachability of the web management portal - remote unauthenticated exploitation against default configurations of Lantronix SLC8000, EMG8500/EMG7500, SLB882, and SLCx-03/SLCx-02 devices. The attacker only needs HTTP access to the web configuration server's upload endpoint and supplies a cookie value of a specific length to trigger the snprintf path truncation; no credentials, user interaction, or non-default settings are required. The primary limiting factor is network exposure of the management interface: risk is highest where the portal is internet- or management-network-facing, and lower where it is isolated. Patched firmware exists for SLC8000 (9.7.0.5) and EMG8500/EMG7500 (9.7.0.1), but SLB882/SLCx-03/SLCx-02 are affected in all firmware versions.

This is a genuine top-tier priority, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H) scores a maximal 10.0, and the description substantiates every metric: a remote, unauthenticated attacker manipulates a session-cookie length to force an snprintf path truncation and path-traversal that redirects auth validation to an arbitrary on-disk file (e.g. the local user database), fully bypassing session checks, then reads config and writes files to arbitrary locations for RCE. The attack is deterministic (fixed-size buffer truncation at a known delimiter), so AC:L is well-justified and no user interaction or authentication is needed. EPSS and CISA KEV data were not provided in the input, so exploitation-probability and active-exploitation signals cannot be confirmed here; absence of a KEV entry should not be read as low risk given the trivially reproducible, unauthenticated nature. The flaw was reported by VulnCheck with a public technical advisory and an independent writeup (revrb.net), which meaningfully lowers the barrier to weaponization even though no packaged exploit code is confirmed in the input. Note the affected SLB882/SLCx-03/SLCx-02 lines are flagged as vulnerable across ALL firmware versions with fixes only shipped for SLC8000/EMG models, meaning some products have no patched build listed - an important gap for defenders.

An attacker who can reach the device's web management portal (often exposed for out-of-band/remote administration) sends a crafted request to the upload endpoint with a cookie value of a specific length, causing the server's snprintf-built cookie file path to truncate and traverse to an arbitrary file, bypassing all session authentication. With authentication defeated, the attacker reads sensitive configuration and writes a file to an arbitrary filesystem location to achieve remote code execution as the web server. Detailed public advisories from VulnCheck and revrb.net describe the mechanism, though no packaged exploit is confirmed in the provided data.