Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lantronix | SLC8000 | all versions | — | No fix listed | CNA |
| Lantronix | EMG8500 | all versions | — | No fix listed | CNA |
| Lantronix | EMG7500 | all versions | — | No fix listed | CNA |
| Lantronix | SLB882 | all versions | — | No fix listed | CNA |
| Lantronix | SLCx-03 | all versions | — | No fix listed | CNA |
| Lantronix | SLCx-02 | all versions | — | No fix listed | CNA |
| Lantronix | SLC9000 | all versions | — | No fix listed | CNA |
- SLC8000 VendorLantronix Affected all versions Fixed in — No fix listed CNA
- EMG8500 VendorLantronix Affected all versions Fixed in — No fix listed CNA
- EMG7500 VendorLantronix Affected all versions Fixed in — No fix listed CNA
- SLB882 VendorLantronix Affected all versions Fixed in — No fix listed CNA
- SLCx-03 VendorLantronix Affected all versions Fixed in — No fix listed CNA
- SLCx-02 VendorLantronix Affected all versions Fixed in — No fix listed CNA
- SLC9000 VendorLantronix Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-80154
- 2026-10-03 Alias added: GHSA-c7q9-4pfw-ph5m
- 2026-10-30 EPSS moved to the 50th–90th percentile
References
Other 1
More Lantronix vulnerabilities
- TI-2025-41112 Lantronix EDS5000, G520, and X300 OS Command Injection KEVCVSS 4.0CRITICAL 9.3
- TI-2021-04926 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
- TI-2021-04937 Stack-based buffer overflow in Lantronix CVSS 3.1CRITICAL 9.9
- TI-2026-55403 Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation CVSS 4.0CRITICAL 10.0
- TI-2021-04928 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
- TI-2021-04917 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
Sources
- CVE-2026-80154 · CVE Program
- CVE-2026-80154 · NVD
- FIRST EPSS
- GHSA-c7q9-4pfw-ph5m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences