External risk intelligence

Lantronix Command Injection via MFC EEPROM Write

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-80144

The affected products are Out-of-Band (OOB) management appliances, such as console servers, typically deployed to provide remote access to network infrastructure. These devices are frequently exposed to management networks or directly reachable via the internet to facilitate remote administration, placing them in a position where they are commonly accessed as edge or gateway services.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves command injection in certain Lantronix out-of-band management devices, allowing authenticated attackers to execute arbitrary commands with root privileges. Exploiting this could lead to a complete compromise of the affected device and potentially impact connected serial devices.

Unsanitized input allows attackers to run commands.
Compromise of management devices can affect network infrastructure.
Confirm relevance and exposure of these critical management tools.

Attack Path

How an attacker could exploit the issue

An attacker can gain access to the device's terminal or command-line interface by authenticating as any user. From there, they can send an undocumented command that passes user-provided input directly to a system function without proper sanitization, allowing them to execute arbitrary shell commands with root privileges. This can lead to a complete compromise of the device's confidentiality, integrity, and availability, and potentially affect other connected devices.

Requires authenticated access to the device.
Exploits an undocumented command with unsanitized input.
Results in full system control and data compromise.

Live Threat

Current exploitation, exposure, and threat context

Authenticated attackers can execute arbitrary shell commands as root on affected Lantronix devices by exploiting an undocumented command that passes unsanitized user input to a system call. This could lead to a complete loss of confidentiality, integrity, and availability on the device, and potentially impact downstream connected serial devices.

System control and data integrity at risk.
Exploits unsanitized input via undocumented command.
Complete device compromise and downstream impact.

Operational Fix

Recommended remediation, mitigation, and detection steps

The command injection vulnerability in Lantronix SLC8000/SLC9000, EMG8500/EMG7500, and SLB882/SLCx-03/SLCx-02 devices necessitates action from teams responsible for network infrastructure and security appliances. The initial step should be to identify all instances of the affected devices, determine their network exposure, assess their business criticality, and pinpoint the accountable owner for remediation planning.

Infrastructure and security teams should own.
Verify device reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Lantronix equipment affected by CVE-2026-80144?

These devices, including the SLC8000, SLC9000, EMG8500, EMG7500, and SLB882 models, are out-of-band management appliances. They serve as console servers, acting as a secondary, independent communication path to configure, monitor, and recover network equipment like routers and switches if the primary network fails.

What kind of vulnerability is CVE-2026-80144?

This is a command injection vulnerability, classified as CWE-78. It occurs when a program takes user-supplied data and sends it to a system shell without first cleaning or checking it. In this instance, an undocumented management command fails to sanitize input, allowing an attacker to insert their own instructions that the device then executes as if they were legitimate system commands.

Does this vulnerability trigger automatically?

No. The vulnerability does not execute through passive network traffic or unsolicited triggers. A successful exploit requires an attacker to first achieve authenticated access to the terminal or command-line interface. Once authenticated, they must manually invoke the specific undocumented command and supply the malicious input to initiate the injection.

Why does Halo Surface Signal categorize this as an external risk?

Halo Surface Signal identifies these as edge or gateway services because these console servers are often intentionally placed on management networks or directly connected to the internet to ensure remote access to infrastructure. Because they are designed for remote management, they are frequently reachable from outside the primary internal network perimeter, increasing the likelihood of exposure.

How should I respond if I manage these Lantronix devices?

Begin by auditing your environment to inventory all listed models and determine which are currently reachable from the internet versus those strictly on internal management segments. Verify your firmware versions against the provided guidance to identify if an update is required. Finally, coordinate with your infrastructure team to establish a patching timeline for the affected hardware.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.