High severity · published Sep 22, 2026
CVE-2026-80148
Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation
8.6
CVSS
0.6%
EPSS
No
On KEV
Description
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
EMG7500 · LANTRONIX
before 9.7.0.1 · source: vendor
EM
EMG8500 · LANTRONIX
before 9.7.0.1 · source: vendor
SL
SLB882 · LANTRONIX
All versions, or not specified · source: vendor
SL
SLC8000 · LANTRONIX
before 9.7.0.3 · source: vendor
SL
SLC9000 · LANTRONIX
before 9.7.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80148
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80148
revrb.net
https://revrb.net/2026/09/21/revrb-lantern.html
ts.lantronix.com
https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/
ts.lantronix.com
https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
ts.lantronix.com
https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/
ts.lantronix.com
https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/
www.vulncheck.com
https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-username-truncation
More from EMG7500
10.0
CVE-2026-80155
Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation
9.9
CVE-2026-80147
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write
9.9
CVE-2026-80146
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read
9.9
CVE-2026-80144
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write
9.9
CVE-2026-80143
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read