Vulnerability Description
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://revrb.net/2026/09/21/revrb-lantern.html
- https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/
- https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
- https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/
- https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/
- https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cl
FAQ
What is CVE-2026-80145?
CVE-2026-80145 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows ...
How severe is CVE-2026-80145?
CVE-2026-80145 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-80145?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.