CVE-2026-80146: Lantronix Device Buffer Overflow Vulnerability

CVE-2026-80146 Overview

CVE-2026-80146 is a stack-based buffer overflow [CWE-121] affecting Lantronix out-of-band management devices, including the SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 product lines. The flaw resides in an undocumented mfc eeprom read command exposed through the terminal and CLI interfaces. Authenticated attackers can supply oversized input that overflows a bounded stack buffer before the data is passed to a system() call. Successful exploitation can lead to arbitrary code execution on the device and impact downstream serial-attached equipment.

Critical Impact
Any authenticated user on the CLI or terminal interface can trigger memory corruption that may result in full compromise of console servers used to manage critical infrastructure.

Affected Products

Lantronix SLC8000 before firmware v9.7.0.2
Lantronix EMG8500 and EMG7500 before firmware v9.7.0.1
Lantronix SLB882, SLCx-03, and SLCx-02 (all firmware versions)

Discovery Timeline

2026-09-22 - CVE-2026-80146 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-80146

Vulnerability Analysis

The vulnerability exists in an undocumented diagnostic command, mfc eeprom read, exposed through the device management interfaces. The command reads user-supplied input into a fixed-size stack buffer without validating the length of the input. The data is subsequently passed to a system() call, compounding the risk by introducing a command execution primitive alongside the memory corruption. Attackers with any valid credentials, including low-privilege accounts, can reach the vulnerable code path over the network. Because these devices function as autonomous out-of-band management gateways, compromise can cascade to serial-attached routers, switches, PDUs, and other downstream systems.

Root Cause

The root cause is missing bounds checking in the handler for the mfc eeprom read command. Input is copied into a bounded stack buffer using an unsafe copy operation, allowing adjacent stack data, saved registers, and the return address to be overwritten. The subsequent system() invocation on attacker-controlled data provides an additional injection primitive.

Attack Vector

Exploitation requires network access to the CLI or terminal interface and valid credentials for any user account. Once authenticated, the attacker issues the undocumented mfc eeprom read command with an oversized argument. The overflow corrupts stack memory and can be leveraged for control-flow hijacking. See the VulnCheck Advisory on Lantronix Overflow and the Revrb Lantern Overview for additional technical context.

No public proof-of-concept exploit code has been released for this issue at the time of writing.

Detection Methods for CVE-2026-80146

Indicators of Compromise

CLI or terminal session logs containing the string mfc eeprom read followed by unusually long argument data.
Unexpected device reboots, crash logs, or watchdog resets on affected Lantronix appliances.
New or unauthorized outbound connections initiated from the management device to attacker-controlled infrastructure.

Detection Strategies

Enable centralized logging from all Lantronix console servers and forward CLI audit trails to a SIEM for inspection.
Alert on any invocation of undocumented mfc subcommands, since legitimate operators rarely use them.
Correlate authentication events on management interfaces with subsequent CLI command activity to identify anomalous session behavior.

Monitoring Recommendations

Track failed and successful authentications to console server management interfaces from unexpected source addresses.
Monitor firmware versions across the fleet and alert when devices report versions earlier than v9.7.0.2 (SLC8000) or v9.7.0.1 (EMG8500/EMG7500).
Baseline normal CLI command frequency per account and flag statistical outliers, especially oversized command arguments.

How to Mitigate CVE-2026-80146

Immediate Actions Required

Upgrade SLC8000 devices to firmware v9.7.0.2 or later and EMG8500/EMG7500 devices to firmware v9.7.0.1 or later.
Isolate SLB882, SLCx-03, and SLCx-02 devices, since no fixed firmware is available and all versions remain vulnerable.
Rotate all credentials on affected devices and audit account inventories to remove unused or shared accounts.
Restrict management interface access to a dedicated administrative network segment or jump host.

Patch Information

Lantronix has published fixed firmware images. Download packages directly from the vendor:

Workarounds

Place affected devices behind a firewall that restricts CLI and terminal access to a small allow-list of administrator source addresses.
Disable network-exposed management protocols where operationally feasible and require access through an out-of-band bastion.
Enforce strong, unique credentials and multi-factor authentication on any upstream jump host used to reach the device CLI.
For end-of-support SLB882, SLCx-03, and SLCx-02 devices, plan replacement with supported hardware since no patch is available.

bash

# Example: restrict access to Lantronix management interfaces at the network edge
# Replace 10.10.0.0/24 with your administrative subnet and 192.0.2.10 with the device IP
iptables -A FORWARD -s 10.10.0.0/24 -d 192.0.2.10 -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -s 10.10.0.0/24 -d 192.0.2.10 -p tcp --dport 23 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 22 -j DROP
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 23 -j DROP