Read the docs
TI-2026-55395 Aliases CVE-2026-80146GHSA-88xg-5qpc-c627

Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read

Priority MEDIUM 44CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00848 58th percentileScored 2026-11-07
Fix Fixed SLC8000 (LANTRONIX): 9.7.0.2EMG8500 (LANTRONIX): 9.7.0.1+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LantronixSLC8000before 9.7.0.29.7.0.2Patch availableCNA
LantronixEMG8500before 9.7.0.19.7.0.1Patch availableCNA
LantronixEMG7500before 9.7.0.19.7.0.1Patch availableCNA
LantronixSLB882all versions—No fix listedCNA
LantronixSLCx-03all versions—No fix listedCNA
LantronixSLCx-02all versions—No fix listedCNA
LantronixSLC9000before 9.7.0.29.7.0.2Patch availableCNA
  • SLC8000 VendorLantronix Affected before 9.7.0.2 Fixed in 9.7.0.2 Patch available CNA
  • EMG8500 VendorLantronix Affected before 9.7.0.1 Fixed in 9.7.0.1 Patch available CNA
  • EMG7500 VendorLantronix Affected before 9.7.0.1 Fixed in 9.7.0.1 Patch available CNA
  • SLB882 VendorLantronix Affected all versions Fixed in — No fix listed CNA
  • SLCx-03 VendorLantronix Affected all versions Fixed in — No fix listed CNA
  • SLCx-02 VendorLantronix Affected all versions Fixed in — No fix listed CNA
  • SLC9000 VendorLantronix Affected before 9.7.0.2 Fixed in 9.7.0.2 Patch available CNA

Remediation

  • Fix · CNA SLC8000 (LANTRONIX) Fixed in 9.7.0.2
  • Fix · CNA EMG8500 (LANTRONIX) Fixed in 9.7.0.1
  • Fix · CNA EMG7500 (LANTRONIX) Fixed in 9.7.0.1
  • Fix · CNA SLC9000 (LANTRONIX) Fixed in 9.7.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    LANTRONIX EMG7500, EMG8500, SLC9000 9.7.0.1, 9.7.0.2

    12 records Highest priority Priority MEDIUM 12 MEDIUM

    Other records, highest priority first

    • TI-2026-55403 Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path TruncationPriority MEDIUM 51
    • TI-2026-55401 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedulePriority MEDIUM 46
    • TI-2026-55400 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs downloadPriority MEDIUM 46
    Show all 12 records →
  • Release ·

    LANTRONIX SLC8000 9.7.0.2

    5 records Highest priority Priority MEDIUM 5 MEDIUM

    Other records, highest priority first

    • TI-2026-55394 Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs passwordPriority MEDIUM 46
    • TI-2026-55393 Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom writePriority MEDIUM 46
    • TI-2026-55392 Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom readPriority MEDIUM 46
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-80146
  2. 2026-10-03 Alias added: GHSA-88xg-5qpc-c627

References

Patch 4

Other 1

  • TI-2025-41112 Lantronix EDS5000, G520, and X300 OS Command Injection KEVCVSS 4.0CRITICAL 9.3
  • TI-2021-04926 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2021-04937 Stack-based buffer overflow in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2026-55403 Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation CVSS 4.0CRITICAL 10.0
  • TI-2021-04928 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2021-04917 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
See all 61 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences