External risk intelligence

Lantronix Console Server Stack Buffer Overflow via Undocumented Command

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-80146

The affected products are console managers and out-of-band management appliances designed to be network-accessible for remote infrastructure management. These devices are commonly deployed as gateways for terminal and CLI access in data centers and network environments, making their management interfaces frequently reachable over the network.

Buffer Overflow

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts Lantronix console server devices, which are critical for remote access to network equipment. An authenticated attacker could exploit a buffer overflow flaw to potentially gain control of the device, compromising the confidentiality, integrity, and availability of the device and any connected equipment.

Unauthenticated access to critical management devices.
Manages remote infrastructure access and control.
Confirm relevance and exposure to this technology.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by authenticating to the terminal or CLI interface of an affected Lantronix device. Once authenticated, they can send a specially crafted, oversized input to an undocumented command, triggering a stack-based buffer overflow. This overflow, if successful, can lead to arbitrary code execution, potentially compromising the device and connected serial devices.

Authenticated access to terminal or CLI.
Triggered by oversized input to undocumented command.
Risk of code execution and device compromise.

Live Threat

Current exploitation, exposure, and threat context

Authenticated attackers who can access the terminal or CLI interface could potentially execute arbitrary code on the affected Lantronix devices. This is due to a stack-based buffer overflow vulnerability exploited via an undocumented `mfc eeprom read` command. Successful exploitation could lead to complete loss of confidentiality, integrity, and availability on the device, and may also affect downstream serial-attached devices.

Loss of device control and data.
Triggered by authenticated user input.
Compromise of device and connected systems.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Lantronix console servers and gateways are typically managed by infrastructure or platform teams, with oversight from network and security teams responsible for device access and vulnerability management. The first practical step is to identify all deployed instances of these devices, confirm their network exposure and business criticality, and then locate the accountable owner to plan a coordinated remediation.

Infrastructure or platform teams own the issue.
Verify network exposure and asset criticality.
Plan firmware updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What are Lantronix SLC and EMG series devices?

These devices are console managers and out-of-band management gateways. They serve as specialized access points, allowing administrators to remotely manage critical IT infrastructure like servers, routers, and switches via serial console ports. Because they provide a "backdoor" to physical hardware, they are essential tools for maintaining connectivity during network outages.

What is the nature of the CVE-2026-80146 vulnerability?

This flaw is a stack-based buffer overflow, classified as CWE-121. It occurs when the device's software improperly manages memory while processing an undocumented command related to EEPROM data. By sending more data than the system expects, an attacker can overwrite adjacent memory, potentially forcing the device to execute malicious instructions instead of intended system tasks.

How is this vulnerability triggered?

The issue is triggered by an authenticated user sending an oversized input string through an undocumented 'mfc eeprom read' command via the terminal or CLI. Simply connecting to the device is insufficient; the attacker must have valid credentials to access the command-line interface. Standard operations that do not invoke this specific, hidden diagnostic command do not trigger the overflow.

Why should I be concerned about CVE-2026-80146?

Halo Surface Signal indicates these devices are designed to be network-accessible for remote management, making their interfaces common targets. If an attacker gains valid credentials, they can compromise the device entirely. This is particularly dangerous because the console manager acts as a gateway; gaining control here potentially provides access to every other sensitive device plugged into its serial ports.

How do I respond to this threat?

Begin by inventorying your environment to locate all SLC and EMG units. Confirm which instances are reachable over your network versus those restricted to internal management segments. Contact the infrastructure or operations team responsible for these devices to verify their firmware version and schedule an update to the patched release during a maintenance window to mitigate the risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.