CVE-2026-80143 Overview
CVE-2026-80143 is a command injection vulnerability [CWE-78] affecting multiple Lantronix out-of-band management devices. The flaw resides in an undocumented mfc eeprom read command exposed through the terminal and CLI interfaces. Authenticated users can pass unsanitized input to a system() call and execute arbitrary shell commands as root. Successful exploitation compromises the device and any serial-attached downstream equipment managed through it.
Critical Impact
Any authenticated CLI user can obtain root shell execution on affected Lantronix console servers, pivoting to serial-attached infrastructure such as routers, switches, and PDUs.
Affected Products
- Lantronix SLC8000 before firmware v9.7.0.2
- Lantronix EMG8500 and EMG7500 before firmware v9.7.0.1
- Lantronix SLB882, SLCx-03, and SLCx-02 (all firmware versions)
Discovery Timeline
- 2026-09-22 - CVE-2026-80143 published to NVD
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-80143
Vulnerability Analysis
The vulnerability exists in the CLI handler for the undocumented mfc eeprom read command. The handler concatenates user-supplied arguments directly into a shell command string and executes it through a system() call. Because no input sanitization or argument escaping is performed, shell metacharacters such as ;, |, &&, and backticks are interpreted by the underlying shell.
The CLI process runs with root privileges, so injected commands inherit full system authority. This allows attackers to read or modify firmware, extract credentials, alter configuration, and execute persistent implants. Because these devices provide out-of-band management for critical infrastructure, an attacker who compromises the console server can also manipulate any device connected through its serial ports.
Root Cause
The root cause is OS command injection [CWE-78] caused by passing untrusted parameters from an interactive command interpreter into system() without validation or safe argument handling. The mfc eeprom read command was intended for manufacturing use and was left reachable from post-authentication CLI contexts available to any local user account.
Attack Vector
An attacker requires only low-privilege authenticated access to the terminal or CLI interface. After authenticating as any valid user, the attacker issues the mfc eeprom read command with a crafted parameter containing shell metacharacters. The injected payload executes as root. Attackers with network access to the management interface can chain this with default or weak credentials commonly found on out-of-band devices. See the VulnCheck CLI Command Injection Advisory and the RevRB Lantern Overview for technical details.
Detection Methods for CVE-2026-80143
Indicators of Compromise
- CLI session logs containing the string mfc eeprom read followed by shell metacharacters such as ;, |, &, $(, or backticks.
- Unexpected outbound network connections from the Lantronix management interface to attacker-controlled hosts.
- New or modified files under writable directories on the device, or unexpected changes to serial port configuration.
- Authentication events from unusual source IPs preceding CLI activity involving manufacturing commands.
Detection Strategies
- Enable and forward CLI audit logs from Lantronix devices to a central log store and alert on any invocation of mfc eeprom read.
- Baseline expected administrative commands and flag deviations, since mfc eeprom read should never appear in normal operations.
- Correlate CLI login events with subsequent network egress from the device management VLAN.
Monitoring Recommendations
- Ingest Lantronix syslog into a centralized SIEM for retention and correlation with identity events.
- Monitor management-plane network segments for unexpected traffic originating from console servers.
- Alert on authentication failures and successful logins from non-administrator source ranges.
How to Mitigate CVE-2026-80143
Immediate Actions Required
- Upgrade SLC8000 to firmware v9.7.0.2 or later and EMG8500/EMG7500 to v9.7.0.1 or later.
- Retire or isolate SLB882, SLCx-03, and SLCx-02 devices, since no fixed firmware is available.
- Rotate all local and remote authentication credentials on affected devices after patching.
- Restrict management-interface access to a dedicated administration network with strict ACLs.
Patch Information
Lantronix has published fixed firmware for the supported product lines. See the vendor firmware directories for SLC8000, SLC9000, EMG7500, and EMG8500. SLB882, SLCx-03, and SLCx-02 remain unpatched across all firmware versions.
Workarounds
- Place management interfaces behind a jump host and require multi-factor authentication before CLI access.
- Enforce strong, unique credentials for every user account and remove shared or default accounts.
- Disable network access to unused management protocols such as Telnet and legacy SSH ciphers.
- Continuously audit which accounts can reach the CLI, since exploitation requires only low-privileged authentication.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
