Read the docs
TI-2026-55403 Aliases CVE-2026-80155GHSA-h7c7-c453-99x2

Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation

Priority MEDIUM 51CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01025 63rd percentileScored 2026-11-07
Fix Fixed SLC8000 (LANTRONIX): 9.7.0.5EMG8500 (LANTRONIX): 9.7.0.1+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LantronixSLC8000before 9.7.0.59.7.0.5Patch availableCNA
LantronixEMG8500before 9.7.0.19.7.0.1Patch availableCNA
LantronixEMG7500before 9.7.0.19.7.0.1Patch availableCNA
LantronixSLB882all versions—No fix listedCNA
LantronixSLCx-03all versions—No fix listedCNA
LantronixSLCx-02all versions—No fix listedCNA
LantronixSLC9000before 9.7.0.29.7.0.2Patch availableCNA
  • SLC8000 VendorLantronix Affected before 9.7.0.5 Fixed in 9.7.0.5 Patch available CNA
  • EMG8500 VendorLantronix Affected before 9.7.0.1 Fixed in 9.7.0.1 Patch available CNA
  • EMG7500 VendorLantronix Affected before 9.7.0.1 Fixed in 9.7.0.1 Patch available CNA
  • SLB882 VendorLantronix Affected all versions Fixed in — No fix listed CNA
  • SLCx-03 VendorLantronix Affected all versions Fixed in — No fix listed CNA
  • SLCx-02 VendorLantronix Affected all versions Fixed in — No fix listed CNA
  • SLC9000 VendorLantronix Affected before 9.7.0.2 Fixed in 9.7.0.2 Patch available CNA

Remediation

  • Fix · CNA SLC8000 (LANTRONIX) Fixed in 9.7.0.5
  • Fix · CNA EMG8500 (LANTRONIX) Fixed in 9.7.0.1
  • Fix · CNA EMG7500 (LANTRONIX) Fixed in 9.7.0.1
  • Fix · CNA SLC9000 (LANTRONIX) Fixed in 9.7.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    LANTRONIX EMG7500, EMG8500, SLC9000 9.7.0.1, 9.7.0.2

    12 records Highest priority Priority MEDIUM 12 MEDIUM

    Other records, highest priority first

    • TI-2026-55401 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedulePriority MEDIUM 46
    • TI-2026-55400 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs downloadPriority MEDIUM 46
    • TI-2026-55394 Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs passwordPriority MEDIUM 46
    Show all 12 records →
  • Release ·

    LANTRONIX SLC8000 9.7.0.5

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-55404 Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation BypassPriority MEDIUM 44
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-80155
  2. 2026-10-03 Alias added: GHSA-h7c7-c453-99x2

References

Patch 4

Other 1

  • TI-2025-41112 Lantronix EDS5000, G520, and X300 OS Command Injection KEVCVSS 4.0CRITICAL 9.3
  • TI-2021-04926 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2021-04937 Stack-based buffer overflow in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2021-04928 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2021-04917 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2014-07334 Lantronix xPrintServer does not properly restrict access to ips/, which allows remote… CVSS 2.0HIGH 10.0
See all 61 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences