Read the docs
TI-2026-55398 Aliases CVE-2026-80149GHSA-rpxf-vw4h-fp98

Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter

Priority MEDIUM 40CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0058 47th percentileScored 2026-11-07
Fix Fixed SLC8000 (LANTRONIX): 9.7.0.3EMG8500 (LANTRONIX): 9.7.0.1+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LantronixSLC8000before 9.7.0.39.7.0.3Patch availableCNA
LantronixEMG8500before 9.7.0.19.7.0.1Patch availableCNA
LantronixEMG7500before 9.7.0.19.7.0.1Patch availableCNA
LantronixSLB882all versions—No fix listedCNA
LantronixSLC9000before 9.7.0.29.7.0.2Patch availableCNA
  • SLC8000 VendorLantronix Affected before 9.7.0.3 Fixed in 9.7.0.3 Patch available CNA
  • EMG8500 VendorLantronix Affected before 9.7.0.1 Fixed in 9.7.0.1 Patch available CNA
  • EMG7500 VendorLantronix Affected before 9.7.0.1 Fixed in 9.7.0.1 Patch available CNA
  • SLB882 VendorLantronix Affected all versions Fixed in — No fix listed CNA
  • SLC9000 VendorLantronix Affected before 9.7.0.2 Fixed in 9.7.0.2 Patch available CNA

Remediation

  • Fix · CNA SLC8000 (LANTRONIX) Fixed in 9.7.0.3
  • Fix · CNA EMG8500 (LANTRONIX) Fixed in 9.7.0.1
  • Fix · CNA EMG7500 (LANTRONIX) Fixed in 9.7.0.1
  • Fix · CNA SLC9000 (LANTRONIX) Fixed in 9.7.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    LANTRONIX EMG7500, EMG8500, SLC9000 9.7.0.1, 9.7.0.2

    12 records Highest priority Priority MEDIUM 12 MEDIUM

    Other records, highest priority first

    • TI-2026-55403 Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path TruncationPriority MEDIUM 51
    • TI-2026-55401 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedulePriority MEDIUM 46
    • TI-2026-55400 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs downloadPriority MEDIUM 46
    Show all 12 records →
  • Release ·

    LANTRONIX SLC8000 9.7.0.3

    5 records Highest priority Priority MEDIUM 5 MEDIUM

    Other records, highest priority first

    • TI-2026-55401 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedulePriority MEDIUM 46
    • TI-2026-55400 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs downloadPriority MEDIUM 46
    • TI-2026-55399 Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl ParameterPriority MEDIUM 40
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-80149
  2. 2026-10-03 Alias added: GHSA-rpxf-vw4h-fp98

References

Patch 4

Other 1

  • TI-2025-41112 Lantronix EDS5000, G520, and X300 OS Command Injection KEVCVSS 4.0CRITICAL 9.3
  • TI-2021-04926 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2021-04937 Stack-based buffer overflow in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2026-55403 Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation CVSS 4.0CRITICAL 10.0
  • TI-2021-04928 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2021-04917 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
See all 61 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences