Read the docs
TI-2026-55404 Aliases CVE-2026-80156GHSA-hmch-26g2-q5qx

Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device's filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00697 53rd percentileScored 2026-11-07
Fix Fixed SLC8000 (LANTRONIX): 9.7.0.5EMG8500 (LANTRONIX): 9.7.0.1+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LantronixSLC8000before 9.7.0.59.7.0.5Patch availableCNA
LantronixEMG8500before 9.7.0.19.7.0.1Patch availableCNA
LantronixEMG7500before 9.7.0.19.7.0.1Patch availableCNA
LantronixSLB882all versions—No fix listedCNA
LantronixSLCx-03all versions—No fix listedCNA
LantronixSLCx-02all versions—No fix listedCNA
LantronixSLC9000before 9.7.0.29.7.0.2Patch availableCNA
  • SLC8000 VendorLantronix Affected before 9.7.0.5 Fixed in 9.7.0.5 Patch available CNA
  • EMG8500 VendorLantronix Affected before 9.7.0.1 Fixed in 9.7.0.1 Patch available CNA
  • EMG7500 VendorLantronix Affected before 9.7.0.1 Fixed in 9.7.0.1 Patch available CNA
  • SLB882 VendorLantronix Affected all versions Fixed in — No fix listed CNA
  • SLCx-03 VendorLantronix Affected all versions Fixed in — No fix listed CNA
  • SLCx-02 VendorLantronix Affected all versions Fixed in — No fix listed CNA
  • SLC9000 VendorLantronix Affected before 9.7.0.2 Fixed in 9.7.0.2 Patch available CNA

Remediation

  • Fix · CNA SLC8000 (LANTRONIX) Fixed in 9.7.0.5
  • Fix · CNA EMG8500 (LANTRONIX) Fixed in 9.7.0.1
  • Fix · CNA EMG7500 (LANTRONIX) Fixed in 9.7.0.1
  • Fix · CNA SLC9000 (LANTRONIX) Fixed in 9.7.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    LANTRONIX EMG7500, EMG8500, SLC9000 9.7.0.1, 9.7.0.2

    12 records Highest priority Priority MEDIUM 12 MEDIUM

    Other records, highest priority first

    • TI-2026-55403 Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path TruncationPriority MEDIUM 51
    • TI-2026-55401 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedulePriority MEDIUM 46
    • TI-2026-55400 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs downloadPriority MEDIUM 46
    Show all 12 records →
  • Release ·

    LANTRONIX SLC8000 9.7.0.5

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-55403 Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path TruncationPriority MEDIUM 51
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-80156
  2. 2026-10-03 Alias added: GHSA-hmch-26g2-q5qx

References

Patch 4

Other 1

  • TI-2025-41112 Lantronix EDS5000, G520, and X300 OS Command Injection KEVCVSS 4.0CRITICAL 9.3
  • TI-2021-04926 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2021-04937 Stack-based buffer overflow in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2026-55403 Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation CVSS 4.0CRITICAL 10.0
  • TI-2021-04928 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
  • TI-2021-04917 OS command injection in Lantronix CVSS 3.1CRITICAL 9.9
See all 61 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences