CVE-2026-80152criticalCWE-78

CVE-2026-80152: falha crítica em LANTRONIX SLC8000

Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule

Publicada em 22 set 2026 · Atualizada em 26 set 2026

Seguir esta CVE + Monitorar EMG7500 + Monitorar EMG8500

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 1.7%

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set script schedule command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Produtos afetados

LANTRONIX · EMG7500 LANTRONIX · EMG8500 LANTRONIX · SLB882 LANTRONIX · SLC8000 LANTRONIX · SLC9000 LANTRONIX · SLCx-02 LANTRONIX · SLCx-03

CVEs relacionadas — LANTRONIX SLC8000

No mesmo produto, das mais perigosas para as menos.

CVE-2026-80145CRITICALLantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs passwordEPSS 1.9%CVE-2026-80144CRITICALLantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom writeEPSS 1.7%CVE-2026-80143CRITICALLantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom readEPSS 1.7%CVE-2026-80151CRITICALLantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs downloadEPSS 1.7%CVE-2026-80155CRITICALLantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path TruncationEPSS 1.0%CVE-2026-80146CRITICALLantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom readEPSS 0.8%

Referências

https://revrb.net/2026/09/21/revrb-lantern.html https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-os-command-injection-via-set-script-schedule