Emg7500
Monthly
Authenticated file-write path traversal in the Lantronix web management portal lets a logged-in attacker upload a crafted filename that escapes the intended upload directory and writes arbitrary files to any writable location on the device, a primitive that can be leveraged for remote code execution and results in complete loss of confidentiality, integrity, and availability on the console server. Affected are SLC8000 units below firmware v9.7.0.5, EMG8500/EMG7500 below firmware v9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02 (no vendor fix published for those three models). Exploitation requires a valid authenticated session on the network-reachable management portal (CVSS v4.0 PR:H, AV:N), so exposure is highest where the portal is internet-facing or reachable from untrusted segments; there is no public exploit identified at time of analysis and the issue is not listed on CISA KEV, but the assessed impact and the embedded out-of-band role of these devices justify treating it as high priority.
Unauthenticated remote attackers can completely compromise the web management portal of Lantronix console servers, reading sensitive configuration files, writing files to arbitrary filesystem locations, and ultimately achieving remote code execution. Affected are SLC8000 units below firmware 9.7.0.5, EMG8500/EMG7500 units below firmware 9.7.0.1, and SLB882/SLCx-03/SLCx-02 devices, which are vulnerable in every firmware version released to date. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; vendor CVSS 4.0 score 10.0) requires nothing more than HTTP reachability to the portal upload endpoint - no credentials, user interaction or non-default settings - and exploitation yields total loss of confidentiality, integrity and availability on the device plus potential impact on serial-connected downstream equipment; no public exploit code has been identified at time of analysis, though a third-party technical writeup accompanies the disclosure.
Predictable session-token generation in the web management portal of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 console servers allows unauthenticated attackers to derive a valid token belonging to a logged-in user and replay it from a different source address, achieving elevated privileges on the device and potentially on downstream serial-attached equipment. Session tokens are produced deterministically from the device model plus the current time at one-second resolution, leaving only a small enumerable keyspace, and a crafted URI that abuses file-extension handling in the web server's path routing defeats the per-session source-IP and User-Agent validation. Rated CVSS 4.0 base 8.9 (AV:N/AC:L/AT:P/PR:N/UI:A, all impacts High) with our independent assessment at CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; exploitation requires network reachability to the portal and a legitimate user session to be live, no public exploit has been identified at time of analysis, and all firmware versions are affected so version-based mitigation is unavailable from the provided data.
Authenticated command injection in Lantronix SLC8000 console servers (before firmware v9.7.0.3), EMG8500/EMG7500 (before firmware v9.7.0.1), and the SLB882/SLCx-03/SLCx-02 families lets any account holding the 'services' permission run arbitrary shell commands as root via the 'set script schedule' CLI/terminal command, producing a complete loss of confidentiality, integrity and availability on the device and potentially on serial-attached downstream equipment. The vector is network-reachable and requires no user interaction, but it is gated behind a privileged role (PR:H) and reachability of the management/CLI plane, which limits practical exposure to devices whose out-of-band interface is exposed or improperly segregated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches exist for the SLC8000 and EMG models while SLB882/SLCx-03/SLCx-02 remain unpatched in all firmware versions per available data.
Root-level command injection in Lantronix console servers - SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 - lets an authenticated user who holds the 'services' permission run arbitrary shell commands as root by abusing the 'set nfs download' command, whose parameter is passed unsanitized into a system() call, resulting in complete loss of confidentiality, integrity and availability on the device and potential downstream impact on serial-attached equipment. The privilege gate (PR:H) means anonymous or low-privilege users cannot trigger it and no user interaction is required once that role is held; authentication requirements are confirmed as privileged/authenticated by both the CVSS 4.0 vector (PR:H) and our assessed CVSS 3.1 vector (PR:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a high-severity-but-not-currently-exploited defect. Lantronix has shipped firmware v9.7.0.3R3 for SLC8000 and v9.7.0.1R2 for EMG8500/EMG7500, while no fixed build has been published for SLB882, SLCx-03 or SLCx-02.
Server-side request forgery in the WebSSH/WebTelnet listener of Lantronix SLC8000 (before firmware 9.7.0.3), EMG8500/EMG7500 (before firmware 9.7.0.1), and all firmware versions of SLB882 allows unauthenticated remote attackers to make the device open outbound Telnet connections to attacker-chosen hosts by tampering with the rooturl parameter, turning the out-of-band management appliance into a pivot for enumerating or reaching internal network endpoints that are otherwise unreachable from the attacker's position. The flaw sits in the custom shellinaboxd component, which trusts the client-supplied rooturl value to determine its own IP address, and it is remotely exploitable without authentication or user interaction (CVSS:4.0 7.7; independent assessment CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). Impact is bounded to reconnaissance and lateral communication rather than code execution or data corruption; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk depends on whether the management interface is exposed to an attacker-controlled network segment. This is a genuine but bounded risk.
Unauthenticated server-side request forgery in the Lantronix SLC8000, EMG8500/EMG7500 and SLB882 console servers lets any remote party that can reach the WebSSH/WebTelnet listener coerce the device into opening an SSH session to an arbitrary, attacker-chosen host or IP. The flaw lives in the custom shellinaboxd daemon, which derives its own address from the client-supplied rooturl parameter, so tampering with that parameter redirects the terminal connection elsewhere, allowing attackers to enumerate or talk to internal endpoints that are otherwise unreachable. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, though a detailed technical writeup and a VulnCheck advisory describe the mechanism; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, reflecting low confidentiality impact on the device itself and high confidentiality impact on systems behind it.
Unauthenticated server-side request forgery in the WebSSH/WebTelnet web terminal listener of Lantronix SLC8000 console servers (before firmware v9.7.0.3), EMG8500/EMG7500 out-of-band gateways (before firmware v9.7.0.1), and all firmware versions of the SLB882 lets remote attackers make the device open SSH connections of their choosing, including to hosts on internal networks the device can route to but the attacker cannot. The trigger is an overlong username that overflows a fixed-size buffer in a custom shellinaboxd snprintf call, truncating the device-derived IP suffix of the connection target and redirecting it to an attacker-specified endpoint. The independent assessment rates this High (CVSS 4.0 base 7.7, AV:N/AC:L/AT:N/PR:N/UI:N, VC:L/SC:H), remote, unauthenticated and low-complexity, with blind SSRF impact - connection establishment and internal enumeration rather than direct extraction of device data; no public exploit code or confirmed active exploitation was identified at time of analysis.
An authenticated stack-based buffer overflow in Lantronix SLC8000, EMG8500/EMG7500, SLB882 and SLCx-02/SLCx-03 console management devices lets a user who can reach the terminal or CLI interface invoke an undocumented 'mfc eeprom write' command and supply oversized input that overflows a fixed stack buffer before the data is handed to a system() call, potentially yielding arbitrary code execution with full loss of confidentiality, integrity and availability on the device and on serial-attached downstream equipment. The flaw is scored 9.4 (CVSS 4.0, PR:L, scope-changed downstream impact) and requires authentication as any user, including low-privilege accounts, so exposure depends on whether the management interface is network-reachable and on credential strength. Vendor firmware fixes are available for SLC8000 (9.7.0.2), EMG8500 (9.7.0.1) and EMG7500 (9.7.0.1); no public exploit code was identified at time of analysis, though the undocumented command has now been publicly documented by VulnCheck and revrb.net, and SLB882/SLCx-03/SLCx-02 have no vendor patch.
Authenticated remote code execution in Lantronix SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, and SLCx-02 console servers allows an attacker who can reach the terminal/CLI management interface and authenticate with any low-privilege account to trigger a stack-based buffer overflow by invoking the undocumented mfc eeprom read command with oversized input; successful exploitation can potentially achieve arbitrary code execution and complete loss of confidentiality, integrity, and availability, with potential impact to downstream serial-attached devices. Vendor-released patches exist for SLC8000 before v9.7.0.2 and EMG8500/EMG7500 before v9.7.0.1, but no patch was identified for SLB882, SLCx-03, or SLCx-02; no public exploit identified at time of analysis, and real-world urgency is tempered by the authentication requirement and niche console-server deployment. This is consistent with the independent CVSS:3.1 assessment AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and the CVSS 4.0 score of 9.4.
Authenticated command injection in Lantronix console/out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) lets an attacker who already holds the 'services' permission reach the terminal or CLI interface and run arbitrary shell commands as root via a crafted `set cifs password` argument, resulting in complete loss of confidentiality, integrity and availability on the device and possible cascading impact on serial-attached downstream equipment. CVSS 4.0 rates this 9.4 (Critical) on an AV:N/AC:L/PR:H/UI:N vector with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) agrees on severity. The vendor has shipped patched firmware for SLC8000 (9.7.0.2) and for EMG8500/EMG7500 (9.7.0.1), while SLB882, SLCx-03 and SLCx-02 have no fix identified in any firmware version; no public exploit code was identified at time of analysis, and CISA KEV does not list this issue.
Authenticated command injection in Lantronix out-of-band console managers (SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, SLCx-02) allows any logged-in user - no administrative rights required - to execute arbitrary shell commands as root by abusing an undocumented 'mfc eeprom write' CLI command whose parameter is passed unsanitized into a system() call. Successful exploitation yields complete loss of confidentiality, integrity, and availability on the device itself, and, because these are serial/console aggregation appliances, can extend to downstream serial-attached equipment (CVSS v4.0 base 9.4; independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exposure is gated by prerequisites: a valid account of any privilege level plus network reachability to the terminal or CLI/console interface are required, and there is no public exploit identified at time of analysis - though the technical barrier is low for anyone who already holds credentials. Remediation is available for SLC8000 (9.7.0.2R1) and EMG8500/EMG7500 (9.7.0.1R2), but SLB882, SLCx-03, and SLCx-02 have no fix in any firmware version and require compensating controls.
Authenticated OS command injection in Lantronix out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) allows any user holding valid CLI or terminal credentials - not necessarily administrative - to execute arbitrary shell commands as root through the undocumented 'mfc eeprom read' command, which passes an unsanitized parameter directly to a system() call. CVSS 9.4 with scope-changed impact (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects total loss of confidentiality, integrity and availability on the appliance itself and plausible follow-on compromise of serial-attached downstream devices reachable through its console ports. Exploitability is gated by network reachability of the management interface plus valid low-privilege credentials; no public exploit code has been observed at time of analysis, but a public technical write-up lowers the discovery barrier, and the SLB882/SLCx-03/SLCx-02 model lines have no vendor fix.
Authenticated file-write path traversal in the Lantronix web management portal lets a logged-in attacker upload a crafted filename that escapes the intended upload directory and writes arbitrary files to any writable location on the device, a primitive that can be leveraged for remote code execution and results in complete loss of confidentiality, integrity, and availability on the console server. Affected are SLC8000 units below firmware v9.7.0.5, EMG8500/EMG7500 below firmware v9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02 (no vendor fix published for those three models). Exploitation requires a valid authenticated session on the network-reachable management portal (CVSS v4.0 PR:H, AV:N), so exposure is highest where the portal is internet-facing or reachable from untrusted segments; there is no public exploit identified at time of analysis and the issue is not listed on CISA KEV, but the assessed impact and the embedded out-of-band role of these devices justify treating it as high priority.
Unauthenticated remote attackers can completely compromise the web management portal of Lantronix console servers, reading sensitive configuration files, writing files to arbitrary filesystem locations, and ultimately achieving remote code execution. Affected are SLC8000 units below firmware 9.7.0.5, EMG8500/EMG7500 units below firmware 9.7.0.1, and SLB882/SLCx-03/SLCx-02 devices, which are vulnerable in every firmware version released to date. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; vendor CVSS 4.0 score 10.0) requires nothing more than HTTP reachability to the portal upload endpoint - no credentials, user interaction or non-default settings - and exploitation yields total loss of confidentiality, integrity and availability on the device plus potential impact on serial-connected downstream equipment; no public exploit code has been identified at time of analysis, though a third-party technical writeup accompanies the disclosure.
Predictable session-token generation in the web management portal of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 console servers allows unauthenticated attackers to derive a valid token belonging to a logged-in user and replay it from a different source address, achieving elevated privileges on the device and potentially on downstream serial-attached equipment. Session tokens are produced deterministically from the device model plus the current time at one-second resolution, leaving only a small enumerable keyspace, and a crafted URI that abuses file-extension handling in the web server's path routing defeats the per-session source-IP and User-Agent validation. Rated CVSS 4.0 base 8.9 (AV:N/AC:L/AT:P/PR:N/UI:A, all impacts High) with our independent assessment at CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; exploitation requires network reachability to the portal and a legitimate user session to be live, no public exploit has been identified at time of analysis, and all firmware versions are affected so version-based mitigation is unavailable from the provided data.
Authenticated command injection in Lantronix SLC8000 console servers (before firmware v9.7.0.3), EMG8500/EMG7500 (before firmware v9.7.0.1), and the SLB882/SLCx-03/SLCx-02 families lets any account holding the 'services' permission run arbitrary shell commands as root via the 'set script schedule' CLI/terminal command, producing a complete loss of confidentiality, integrity and availability on the device and potentially on serial-attached downstream equipment. The vector is network-reachable and requires no user interaction, but it is gated behind a privileged role (PR:H) and reachability of the management/CLI plane, which limits practical exposure to devices whose out-of-band interface is exposed or improperly segregated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches exist for the SLC8000 and EMG models while SLB882/SLCx-03/SLCx-02 remain unpatched in all firmware versions per available data.
Root-level command injection in Lantronix console servers - SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 - lets an authenticated user who holds the 'services' permission run arbitrary shell commands as root by abusing the 'set nfs download' command, whose parameter is passed unsanitized into a system() call, resulting in complete loss of confidentiality, integrity and availability on the device and potential downstream impact on serial-attached equipment. The privilege gate (PR:H) means anonymous or low-privilege users cannot trigger it and no user interaction is required once that role is held; authentication requirements are confirmed as privileged/authenticated by both the CVSS 4.0 vector (PR:H) and our assessed CVSS 3.1 vector (PR:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a high-severity-but-not-currently-exploited defect. Lantronix has shipped firmware v9.7.0.3R3 for SLC8000 and v9.7.0.1R2 for EMG8500/EMG7500, while no fixed build has been published for SLB882, SLCx-03 or SLCx-02.
Server-side request forgery in the WebSSH/WebTelnet listener of Lantronix SLC8000 (before firmware 9.7.0.3), EMG8500/EMG7500 (before firmware 9.7.0.1), and all firmware versions of SLB882 allows unauthenticated remote attackers to make the device open outbound Telnet connections to attacker-chosen hosts by tampering with the rooturl parameter, turning the out-of-band management appliance into a pivot for enumerating or reaching internal network endpoints that are otherwise unreachable from the attacker's position. The flaw sits in the custom shellinaboxd component, which trusts the client-supplied rooturl value to determine its own IP address, and it is remotely exploitable without authentication or user interaction (CVSS:4.0 7.7; independent assessment CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). Impact is bounded to reconnaissance and lateral communication rather than code execution or data corruption; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk depends on whether the management interface is exposed to an attacker-controlled network segment. This is a genuine but bounded risk.
Unauthenticated server-side request forgery in the Lantronix SLC8000, EMG8500/EMG7500 and SLB882 console servers lets any remote party that can reach the WebSSH/WebTelnet listener coerce the device into opening an SSH session to an arbitrary, attacker-chosen host or IP. The flaw lives in the custom shellinaboxd daemon, which derives its own address from the client-supplied rooturl parameter, so tampering with that parameter redirects the terminal connection elsewhere, allowing attackers to enumerate or talk to internal endpoints that are otherwise unreachable. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, though a detailed technical writeup and a VulnCheck advisory describe the mechanism; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, reflecting low confidentiality impact on the device itself and high confidentiality impact on systems behind it.
Unauthenticated server-side request forgery in the WebSSH/WebTelnet web terminal listener of Lantronix SLC8000 console servers (before firmware v9.7.0.3), EMG8500/EMG7500 out-of-band gateways (before firmware v9.7.0.1), and all firmware versions of the SLB882 lets remote attackers make the device open SSH connections of their choosing, including to hosts on internal networks the device can route to but the attacker cannot. The trigger is an overlong username that overflows a fixed-size buffer in a custom shellinaboxd snprintf call, truncating the device-derived IP suffix of the connection target and redirecting it to an attacker-specified endpoint. The independent assessment rates this High (CVSS 4.0 base 7.7, AV:N/AC:L/AT:N/PR:N/UI:N, VC:L/SC:H), remote, unauthenticated and low-complexity, with blind SSRF impact - connection establishment and internal enumeration rather than direct extraction of device data; no public exploit code or confirmed active exploitation was identified at time of analysis.
An authenticated stack-based buffer overflow in Lantronix SLC8000, EMG8500/EMG7500, SLB882 and SLCx-02/SLCx-03 console management devices lets a user who can reach the terminal or CLI interface invoke an undocumented 'mfc eeprom write' command and supply oversized input that overflows a fixed stack buffer before the data is handed to a system() call, potentially yielding arbitrary code execution with full loss of confidentiality, integrity and availability on the device and on serial-attached downstream equipment. The flaw is scored 9.4 (CVSS 4.0, PR:L, scope-changed downstream impact) and requires authentication as any user, including low-privilege accounts, so exposure depends on whether the management interface is network-reachable and on credential strength. Vendor firmware fixes are available for SLC8000 (9.7.0.2), EMG8500 (9.7.0.1) and EMG7500 (9.7.0.1); no public exploit code was identified at time of analysis, though the undocumented command has now been publicly documented by VulnCheck and revrb.net, and SLB882/SLCx-03/SLCx-02 have no vendor patch.
Authenticated remote code execution in Lantronix SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, and SLCx-02 console servers allows an attacker who can reach the terminal/CLI management interface and authenticate with any low-privilege account to trigger a stack-based buffer overflow by invoking the undocumented mfc eeprom read command with oversized input; successful exploitation can potentially achieve arbitrary code execution and complete loss of confidentiality, integrity, and availability, with potential impact to downstream serial-attached devices. Vendor-released patches exist for SLC8000 before v9.7.0.2 and EMG8500/EMG7500 before v9.7.0.1, but no patch was identified for SLB882, SLCx-03, or SLCx-02; no public exploit identified at time of analysis, and real-world urgency is tempered by the authentication requirement and niche console-server deployment. This is consistent with the independent CVSS:3.1 assessment AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and the CVSS 4.0 score of 9.4.
Authenticated command injection in Lantronix console/out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) lets an attacker who already holds the 'services' permission reach the terminal or CLI interface and run arbitrary shell commands as root via a crafted `set cifs password` argument, resulting in complete loss of confidentiality, integrity and availability on the device and possible cascading impact on serial-attached downstream equipment. CVSS 4.0 rates this 9.4 (Critical) on an AV:N/AC:L/PR:H/UI:N vector with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) agrees on severity. The vendor has shipped patched firmware for SLC8000 (9.7.0.2) and for EMG8500/EMG7500 (9.7.0.1), while SLB882, SLCx-03 and SLCx-02 have no fix identified in any firmware version; no public exploit code was identified at time of analysis, and CISA KEV does not list this issue.
Authenticated command injection in Lantronix out-of-band console managers (SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, SLCx-02) allows any logged-in user - no administrative rights required - to execute arbitrary shell commands as root by abusing an undocumented 'mfc eeprom write' CLI command whose parameter is passed unsanitized into a system() call. Successful exploitation yields complete loss of confidentiality, integrity, and availability on the device itself, and, because these are serial/console aggregation appliances, can extend to downstream serial-attached equipment (CVSS v4.0 base 9.4; independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exposure is gated by prerequisites: a valid account of any privilege level plus network reachability to the terminal or CLI/console interface are required, and there is no public exploit identified at time of analysis - though the technical barrier is low for anyone who already holds credentials. Remediation is available for SLC8000 (9.7.0.2R1) and EMG8500/EMG7500 (9.7.0.1R2), but SLB882, SLCx-03, and SLCx-02 have no fix in any firmware version and require compensating controls.
Authenticated OS command injection in Lantronix out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) allows any user holding valid CLI or terminal credentials - not necessarily administrative - to execute arbitrary shell commands as root through the undocumented 'mfc eeprom read' command, which passes an unsanitized parameter directly to a system() call. CVSS 9.4 with scope-changed impact (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects total loss of confidentiality, integrity and availability on the appliance itself and plausible follow-on compromise of serial-attached downstream devices reachable through its console ports. Exploitability is gated by network reachability of the management interface plus valid low-privilege credentials; no public exploit code has been observed at time of analysis, but a public technical write-up lowers the discovery barrier, and the SLB882/SLCx-03/SLCx-02 model lines have no vendor fix.