External risk intelligence

Lantronix Unauthenticated Code Execution via Stack Buffer Overflow.

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-80147

Affected devices are Out-of-Band management gateways designed for remote administration. These products function as critical network entry points and are typically deployed as internet-facing infrastructure to enable off-site access to console ports and serial-attached equipment, ensuring they remain reachable for remote management.

Buffer Overflow

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Lantronix out-of-band management devices, specifically a stack-based buffer overflow. Exploitation by an authenticated attacker could allow for arbitrary code execution, potentially leading to a complete loss of confidentiality, integrity, and availability for the affected device and any downstream connected equipment.

Flaw allows code execution on management devices.
Such devices control critical remote access.
Confirm if these management devices are in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by first gaining authenticated access to the device's terminal or command-line interface. Once authenticated, they can send a specially crafted, oversized input to an undocumented command. This input will overflow a buffer on the device's stack, potentially leading to arbitrary code execution and a compromise of the device and any connected serial equipment.

Authenticated access to CLI required.
Undocumented command with oversized input triggers overflow.
Potential for full device compromise and downstream impact.

Live Threat

Current exploitation, exposure, and threat context

Authenticated attackers could exploit an undocumented command to execute arbitrary code on Lantronix devices, potentially impacting the confidentiality, integrity, and availability of the affected device and any downstream serial-attached devices.

Device management functions.
Unbounded input to system() call.
Complete loss of device control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Lantronix management devices, suggesting ownership by infrastructure or platform teams responsible for Out-of-Band (OOB) management. The immediate first step is to locate all instances of the affected technology, assess their business criticality and network exposure, and identify the accountable technical owner before planning remediation.

Infrastructure or platform teams own the issue.
Verify asset inventory and network exposure.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Lantronix SLC/EMG series, and what is its role in a network?

These devices are Out-of-Band (OOB) management gateways. They provide engineers with a secure, secondary way to connect to console ports and serial-attached hardware, such as routers or switches, if the primary network becomes unreachable. By serving as a bridge to critical infrastructure, they act as centralized management consoles for remote administration.

How does this stack-based buffer overflow vulnerability work in CVE-2026-80147?

The flaw, classified as CWE-121, occurs when the device processes input for an undocumented EEPROM write command. The system fails to check the size of the incoming data, allowing an attacker to push more information onto the stack than it can hold. This overflow can overwrite adjacent memory, eventually causing the system to execute unintended, arbitrary code.

What must an attacker do to trigger this specific Lantronix vulnerability?

The attacker must first have authenticated access to the device's CLI or terminal interface. Simply being able to reach the device over the network is not enough; the malicious action requires sending an oversized data string to the specific undocumented command. If the attacker cannot successfully authenticate, the command will not be processed, and the overflow cannot be triggered.

Why is this CVE particularly relevant for internet-facing devices?

According to Halo Surface Signal, these gateways are often deployed as internet-facing entry points to ensure remote availability. Because they are designed to be reachable off-site, any exposure to the public internet significantly increases the risk that an attacker could reach the CLI and attempt the authentication required to trigger the overflow.

What are the first steps for someone managing these Lantronix devices?

Identify all instances of the affected models in your network inventory. Assess their placement and ensure they are not unnecessarily exposed to the internet. Since these devices control access to your core infrastructure, coordinate with your platform team to prioritize them for firmware updates during the next available maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.