Slcx 02
Monthly
Authenticated file-write path traversal in the Lantronix web management portal lets a logged-in attacker upload a crafted filename that escapes the intended upload directory and writes arbitrary files to any writable location on the device, a primitive that can be leveraged for remote code execution and results in complete loss of confidentiality, integrity, and availability on the console server. Affected are SLC8000 units below firmware v9.7.0.5, EMG8500/EMG7500 below firmware v9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02 (no vendor fix published for those three models). Exploitation requires a valid authenticated session on the network-reachable management portal (CVSS v4.0 PR:H, AV:N), so exposure is highest where the portal is internet-facing or reachable from untrusted segments; there is no public exploit identified at time of analysis and the issue is not listed on CISA KEV, but the assessed impact and the embedded out-of-band role of these devices justify treating it as high priority.
Unauthenticated remote attackers can completely compromise the web management portal of Lantronix console servers, reading sensitive configuration files, writing files to arbitrary filesystem locations, and ultimately achieving remote code execution. Affected are SLC8000 units below firmware 9.7.0.5, EMG8500/EMG7500 units below firmware 9.7.0.1, and SLB882/SLCx-03/SLCx-02 devices, which are vulnerable in every firmware version released to date. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; vendor CVSS 4.0 score 10.0) requires nothing more than HTTP reachability to the portal upload endpoint - no credentials, user interaction or non-default settings - and exploitation yields total loss of confidentiality, integrity and availability on the device plus potential impact on serial-connected downstream equipment; no public exploit code has been identified at time of analysis, though a third-party technical writeup accompanies the disclosure.
Predictable session-token generation in the web management portal of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 console servers allows unauthenticated attackers to derive a valid token belonging to a logged-in user and replay it from a different source address, achieving elevated privileges on the device and potentially on downstream serial-attached equipment. Session tokens are produced deterministically from the device model plus the current time at one-second resolution, leaving only a small enumerable keyspace, and a crafted URI that abuses file-extension handling in the web server's path routing defeats the per-session source-IP and User-Agent validation. Rated CVSS 4.0 base 8.9 (AV:N/AC:L/AT:P/PR:N/UI:A, all impacts High) with our independent assessment at CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; exploitation requires network reachability to the portal and a legitimate user session to be live, no public exploit has been identified at time of analysis, and all firmware versions are affected so version-based mitigation is unavailable from the provided data.
Authenticated command injection in Lantronix SLC8000 console servers (before firmware v9.7.0.3), EMG8500/EMG7500 (before firmware v9.7.0.1), and the SLB882/SLCx-03/SLCx-02 families lets any account holding the 'services' permission run arbitrary shell commands as root via the 'set script schedule' CLI/terminal command, producing a complete loss of confidentiality, integrity and availability on the device and potentially on serial-attached downstream equipment. The vector is network-reachable and requires no user interaction, but it is gated behind a privileged role (PR:H) and reachability of the management/CLI plane, which limits practical exposure to devices whose out-of-band interface is exposed or improperly segregated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches exist for the SLC8000 and EMG models while SLB882/SLCx-03/SLCx-02 remain unpatched in all firmware versions per available data.
Root-level command injection in Lantronix console servers - SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 - lets an authenticated user who holds the 'services' permission run arbitrary shell commands as root by abusing the 'set nfs download' command, whose parameter is passed unsanitized into a system() call, resulting in complete loss of confidentiality, integrity and availability on the device and potential downstream impact on serial-attached equipment. The privilege gate (PR:H) means anonymous or low-privilege users cannot trigger it and no user interaction is required once that role is held; authentication requirements are confirmed as privileged/authenticated by both the CVSS 4.0 vector (PR:H) and our assessed CVSS 3.1 vector (PR:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a high-severity-but-not-currently-exploited defect. Lantronix has shipped firmware v9.7.0.3R3 for SLC8000 and v9.7.0.1R2 for EMG8500/EMG7500, while no fixed build has been published for SLB882, SLCx-03 or SLCx-02.
An authenticated stack-based buffer overflow in Lantronix SLC8000, EMG8500/EMG7500, SLB882 and SLCx-02/SLCx-03 console management devices lets a user who can reach the terminal or CLI interface invoke an undocumented 'mfc eeprom write' command and supply oversized input that overflows a fixed stack buffer before the data is handed to a system() call, potentially yielding arbitrary code execution with full loss of confidentiality, integrity and availability on the device and on serial-attached downstream equipment. The flaw is scored 9.4 (CVSS 4.0, PR:L, scope-changed downstream impact) and requires authentication as any user, including low-privilege accounts, so exposure depends on whether the management interface is network-reachable and on credential strength. Vendor firmware fixes are available for SLC8000 (9.7.0.2), EMG8500 (9.7.0.1) and EMG7500 (9.7.0.1); no public exploit code was identified at time of analysis, though the undocumented command has now been publicly documented by VulnCheck and revrb.net, and SLB882/SLCx-03/SLCx-02 have no vendor patch.
Authenticated remote code execution in Lantronix SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, and SLCx-02 console servers allows an attacker who can reach the terminal/CLI management interface and authenticate with any low-privilege account to trigger a stack-based buffer overflow by invoking the undocumented mfc eeprom read command with oversized input; successful exploitation can potentially achieve arbitrary code execution and complete loss of confidentiality, integrity, and availability, with potential impact to downstream serial-attached devices. Vendor-released patches exist for SLC8000 before v9.7.0.2 and EMG8500/EMG7500 before v9.7.0.1, but no patch was identified for SLB882, SLCx-03, or SLCx-02; no public exploit identified at time of analysis, and real-world urgency is tempered by the authentication requirement and niche console-server deployment. This is consistent with the independent CVSS:3.1 assessment AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and the CVSS 4.0 score of 9.4.
Authenticated command injection in Lantronix console/out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) lets an attacker who already holds the 'services' permission reach the terminal or CLI interface and run arbitrary shell commands as root via a crafted `set cifs password` argument, resulting in complete loss of confidentiality, integrity and availability on the device and possible cascading impact on serial-attached downstream equipment. CVSS 4.0 rates this 9.4 (Critical) on an AV:N/AC:L/PR:H/UI:N vector with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) agrees on severity. The vendor has shipped patched firmware for SLC8000 (9.7.0.2) and for EMG8500/EMG7500 (9.7.0.1), while SLB882, SLCx-03 and SLCx-02 have no fix identified in any firmware version; no public exploit code was identified at time of analysis, and CISA KEV does not list this issue.
Authenticated command injection in Lantronix out-of-band console managers (SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, SLCx-02) allows any logged-in user - no administrative rights required - to execute arbitrary shell commands as root by abusing an undocumented 'mfc eeprom write' CLI command whose parameter is passed unsanitized into a system() call. Successful exploitation yields complete loss of confidentiality, integrity, and availability on the device itself, and, because these are serial/console aggregation appliances, can extend to downstream serial-attached equipment (CVSS v4.0 base 9.4; independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exposure is gated by prerequisites: a valid account of any privilege level plus network reachability to the terminal or CLI/console interface are required, and there is no public exploit identified at time of analysis - though the technical barrier is low for anyone who already holds credentials. Remediation is available for SLC8000 (9.7.0.2R1) and EMG8500/EMG7500 (9.7.0.1R2), but SLB882, SLCx-03, and SLCx-02 have no fix in any firmware version and require compensating controls.
Authenticated OS command injection in Lantronix out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) allows any user holding valid CLI or terminal credentials - not necessarily administrative - to execute arbitrary shell commands as root through the undocumented 'mfc eeprom read' command, which passes an unsanitized parameter directly to a system() call. CVSS 9.4 with scope-changed impact (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects total loss of confidentiality, integrity and availability on the appliance itself and plausible follow-on compromise of serial-attached downstream devices reachable through its console ports. Exploitability is gated by network reachability of the management interface plus valid low-privilege credentials; no public exploit code has been observed at time of analysis, but a public technical write-up lowers the discovery barrier, and the SLB882/SLCx-03/SLCx-02 model lines have no vendor fix.
Authenticated file-write path traversal in the Lantronix web management portal lets a logged-in attacker upload a crafted filename that escapes the intended upload directory and writes arbitrary files to any writable location on the device, a primitive that can be leveraged for remote code execution and results in complete loss of confidentiality, integrity, and availability on the console server. Affected are SLC8000 units below firmware v9.7.0.5, EMG8500/EMG7500 below firmware v9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02 (no vendor fix published for those three models). Exploitation requires a valid authenticated session on the network-reachable management portal (CVSS v4.0 PR:H, AV:N), so exposure is highest where the portal is internet-facing or reachable from untrusted segments; there is no public exploit identified at time of analysis and the issue is not listed on CISA KEV, but the assessed impact and the embedded out-of-band role of these devices justify treating it as high priority.
Unauthenticated remote attackers can completely compromise the web management portal of Lantronix console servers, reading sensitive configuration files, writing files to arbitrary filesystem locations, and ultimately achieving remote code execution. Affected are SLC8000 units below firmware 9.7.0.5, EMG8500/EMG7500 units below firmware 9.7.0.1, and SLB882/SLCx-03/SLCx-02 devices, which are vulnerable in every firmware version released to date. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; vendor CVSS 4.0 score 10.0) requires nothing more than HTTP reachability to the portal upload endpoint - no credentials, user interaction or non-default settings - and exploitation yields total loss of confidentiality, integrity and availability on the device plus potential impact on serial-connected downstream equipment; no public exploit code has been identified at time of analysis, though a third-party technical writeup accompanies the disclosure.
Predictable session-token generation in the web management portal of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 console servers allows unauthenticated attackers to derive a valid token belonging to a logged-in user and replay it from a different source address, achieving elevated privileges on the device and potentially on downstream serial-attached equipment. Session tokens are produced deterministically from the device model plus the current time at one-second resolution, leaving only a small enumerable keyspace, and a crafted URI that abuses file-extension handling in the web server's path routing defeats the per-session source-IP and User-Agent validation. Rated CVSS 4.0 base 8.9 (AV:N/AC:L/AT:P/PR:N/UI:A, all impacts High) with our independent assessment at CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; exploitation requires network reachability to the portal and a legitimate user session to be live, no public exploit has been identified at time of analysis, and all firmware versions are affected so version-based mitigation is unavailable from the provided data.
Authenticated command injection in Lantronix SLC8000 console servers (before firmware v9.7.0.3), EMG8500/EMG7500 (before firmware v9.7.0.1), and the SLB882/SLCx-03/SLCx-02 families lets any account holding the 'services' permission run arbitrary shell commands as root via the 'set script schedule' CLI/terminal command, producing a complete loss of confidentiality, integrity and availability on the device and potentially on serial-attached downstream equipment. The vector is network-reachable and requires no user interaction, but it is gated behind a privileged role (PR:H) and reachability of the management/CLI plane, which limits practical exposure to devices whose out-of-band interface is exposed or improperly segregated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches exist for the SLC8000 and EMG models while SLB882/SLCx-03/SLCx-02 remain unpatched in all firmware versions per available data.
Root-level command injection in Lantronix console servers - SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 - lets an authenticated user who holds the 'services' permission run arbitrary shell commands as root by abusing the 'set nfs download' command, whose parameter is passed unsanitized into a system() call, resulting in complete loss of confidentiality, integrity and availability on the device and potential downstream impact on serial-attached equipment. The privilege gate (PR:H) means anonymous or low-privilege users cannot trigger it and no user interaction is required once that role is held; authentication requirements are confirmed as privileged/authenticated by both the CVSS 4.0 vector (PR:H) and our assessed CVSS 3.1 vector (PR:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a high-severity-but-not-currently-exploited defect. Lantronix has shipped firmware v9.7.0.3R3 for SLC8000 and v9.7.0.1R2 for EMG8500/EMG7500, while no fixed build has been published for SLB882, SLCx-03 or SLCx-02.
An authenticated stack-based buffer overflow in Lantronix SLC8000, EMG8500/EMG7500, SLB882 and SLCx-02/SLCx-03 console management devices lets a user who can reach the terminal or CLI interface invoke an undocumented 'mfc eeprom write' command and supply oversized input that overflows a fixed stack buffer before the data is handed to a system() call, potentially yielding arbitrary code execution with full loss of confidentiality, integrity and availability on the device and on serial-attached downstream equipment. The flaw is scored 9.4 (CVSS 4.0, PR:L, scope-changed downstream impact) and requires authentication as any user, including low-privilege accounts, so exposure depends on whether the management interface is network-reachable and on credential strength. Vendor firmware fixes are available for SLC8000 (9.7.0.2), EMG8500 (9.7.0.1) and EMG7500 (9.7.0.1); no public exploit code was identified at time of analysis, though the undocumented command has now been publicly documented by VulnCheck and revrb.net, and SLB882/SLCx-03/SLCx-02 have no vendor patch.
Authenticated remote code execution in Lantronix SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, and SLCx-02 console servers allows an attacker who can reach the terminal/CLI management interface and authenticate with any low-privilege account to trigger a stack-based buffer overflow by invoking the undocumented mfc eeprom read command with oversized input; successful exploitation can potentially achieve arbitrary code execution and complete loss of confidentiality, integrity, and availability, with potential impact to downstream serial-attached devices. Vendor-released patches exist for SLC8000 before v9.7.0.2 and EMG8500/EMG7500 before v9.7.0.1, but no patch was identified for SLB882, SLCx-03, or SLCx-02; no public exploit identified at time of analysis, and real-world urgency is tempered by the authentication requirement and niche console-server deployment. This is consistent with the independent CVSS:3.1 assessment AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and the CVSS 4.0 score of 9.4.
Authenticated command injection in Lantronix console/out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) lets an attacker who already holds the 'services' permission reach the terminal or CLI interface and run arbitrary shell commands as root via a crafted `set cifs password` argument, resulting in complete loss of confidentiality, integrity and availability on the device and possible cascading impact on serial-attached downstream equipment. CVSS 4.0 rates this 9.4 (Critical) on an AV:N/AC:L/PR:H/UI:N vector with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) agrees on severity. The vendor has shipped patched firmware for SLC8000 (9.7.0.2) and for EMG8500/EMG7500 (9.7.0.1), while SLB882, SLCx-03 and SLCx-02 have no fix identified in any firmware version; no public exploit code was identified at time of analysis, and CISA KEV does not list this issue.
Authenticated command injection in Lantronix out-of-band console managers (SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, SLCx-02) allows any logged-in user - no administrative rights required - to execute arbitrary shell commands as root by abusing an undocumented 'mfc eeprom write' CLI command whose parameter is passed unsanitized into a system() call. Successful exploitation yields complete loss of confidentiality, integrity, and availability on the device itself, and, because these are serial/console aggregation appliances, can extend to downstream serial-attached equipment (CVSS v4.0 base 9.4; independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exposure is gated by prerequisites: a valid account of any privilege level plus network reachability to the terminal or CLI/console interface are required, and there is no public exploit identified at time of analysis - though the technical barrier is low for anyone who already holds credentials. Remediation is available for SLC8000 (9.7.0.2R1) and EMG8500/EMG7500 (9.7.0.1R2), but SLB882, SLCx-03, and SLCx-02 have no fix in any firmware version and require compensating controls.
Authenticated OS command injection in Lantronix out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) allows any user holding valid CLI or terminal credentials - not necessarily administrative - to execute arbitrary shell commands as root through the undocumented 'mfc eeprom read' command, which passes an unsanitized parameter directly to a system() call. CVSS 9.4 with scope-changed impact (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects total loss of confidentiality, integrity and availability on the appliance itself and plausible follow-on compromise of serial-attached downstream devices reachable through its console ports. Exploitability is gated by network reachability of the management interface plus valid low-privilege credentials; no public exploit code has been observed at time of analysis, but a public technical write-up lowers the discovery barrier, and the SLB882/SLCx-03/SLCx-02 model lines have no vendor fix.