Critical severity · published Sep 22, 2026
CVE-2026-80145
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password
9.1
CVSS
1.9%
EPSS
No
On KEV
Description
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
EMG7500 · LANTRONIX
before 9.7.0.1 · source: vendor
EM
EMG8500 · LANTRONIX
before 9.7.0.1 · source: vendor
SL
SLB882 · LANTRONIX
All versions, or not specified · source: vendor
SL
SLC8000 · LANTRONIX
before 9.7.0.2 · source: vendor
SL
SLC9000 · LANTRONIX
before 9.7.0.2 · source: vendor
SL
SLCx-02 · LANTRONIX
All versions, or not specified · source: vendor
SL
SLCx-03 · LANTRONIX
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80145
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80145
revrb.net
https://revrb.net/2026/09/21/revrb-lantern.html
ts.lantronix.com
https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/
ts.lantronix.com
https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
ts.lantronix.com
https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/
ts.lantronix.com
https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/
www.vulncheck.com
https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-set-cifs-password
More from EMG7500
10.0
CVE-2026-80155
Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation
9.9
CVE-2026-80147
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write
9.9
CVE-2026-80146
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read
9.9
CVE-2026-80144
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write
9.9
CVE-2026-80143
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read