CVE-2026-80147: Lantronix Device Buffer Overflow Vulnerability

CVE-2026-80147 Overview

CVE-2026-80147 is a stack-based buffer overflow [CWE-121] affecting Lantronix out-of-band management devices, including SLC8000, EMG8500, EMG7500, SLB882, and SLCx-03/SLCx-02 appliances. An undocumented mfc eeprom write command in the terminal and CLI interface copies unbounded user input into a fixed-size stack buffer before passing the data to a system() call. Authenticated attackers can supply oversized input to corrupt the stack and potentially execute arbitrary code on the device. Successful exploitation compromises confidentiality, integrity, and availability of the appliance and any downstream serial-attached equipment.

Critical Impact
Authenticated attackers can trigger a stack buffer overflow through an undocumented CLI command, potentially achieving arbitrary code execution on out-of-band management devices that control critical serial-attached infrastructure.

Affected Products

Lantronix SLC8000 before firmware v9.7.0.2
Lantronix EMG8500 and EMG7500 before firmware v9.7.0.1
Lantronix SLB882 and SLCx-03/SLCx-02 (all firmware versions)

Discovery Timeline

2026-09-22 - CVE-2026-80147 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-80147

Vulnerability Analysis

The flaw resides in an undocumented diagnostic command exposed by the terminal and CLI interfaces of affected Lantronix devices. When a user invokes mfc eeprom write, the handler copies attacker-supplied argument data into a bounded stack buffer without validating input length. The buffer is then passed to a system() call, which invokes a shell command constructed from the overflowed data.

Because the overflow occurs on the stack, an attacker can overwrite the saved return address, stack canaries (if disabled or bypassable), and adjacent frame data. On embedded MIPS or ARM builds common to these appliances, this pattern maps directly to control-flow hijacking primitives.

The vulnerability is particularly consequential on out-of-band management hardware. These devices sit on management networks and broker access to serial consoles of routers, switches, PDUs, and other critical infrastructure. Compromise extends laterally to every downstream device.

Root Cause

The root cause is missing bounds validation on user-controlled input passed to a fixed-size stack buffer. The undocumented mfc eeprom write handler trusts caller-supplied length rather than enforcing the destination buffer size, producing a classic [CWE-121] stack overflow.

Attack Vector

Exploitation requires authentication to the terminal or CLI interface at any privilege level. Any valid user account can reach the vulnerable command. Attackers submit an oversized argument to mfc eeprom write to corrupt the stack frame and redirect execution. See the VulnCheck Advisory on Lantronix Buffer Overflow and the Revrb Lantern Overview for technical details.

Detection Methods for CVE-2026-80147

Indicators of Compromise

CLI or terminal session history containing the string mfc eeprom write followed by unusually long argument data.
Unexpected child processes spawned from the CLI process, particularly shells or network utilities invoked shortly after an mfc command.
New or modified files under writable firmware paths, or unexpected outbound connections from the management interface.

Detection Strategies

Enable and forward CLI command auditing from affected Lantronix devices to a centralized logging platform for inspection of mfc command usage.
Alert on authentication events followed by invocation of undocumented or diagnostic commands not part of normal operations.
Baseline expected administrative activity on out-of-band management devices and flag deviations, especially oversized arguments to CLI commands.

Monitoring Recommendations

Monitor management-network traffic to and from Lantronix appliances for anomalous session length, byte volume, or post-authentication behavior.
Track failed and successful authentication events across SSH, Telnet, and serial interfaces on the affected devices.
Correlate downstream serial-attached device behavior with management-plane activity to identify lateral movement stemming from a compromised console server.

How to Mitigate CVE-2026-80147

Immediate Actions Required

Upgrade SLC8000 to firmware v9.7.0.2 or later and EMG8500/EMG7500 to v9.7.0.1 or later using the vendor firmware archives.
For SLB882 and SLCx-03/SLCx-02 devices, which have no fixed firmware, restrict access to the management interface and plan for hardware replacement.
Rotate all local and remote credentials on affected devices after patching, since any authenticated user can trigger the flaw.

Patch Information

Lantronix has released fixed firmware for supported product lines. Download images from the vendor FTP directories: Lantronix SLC8000 Firmware, Lantronix EMG 8500 Firmware, and Lantronix EMG 7500 Firmware. SLB882 and SLCx-03/SLCx-02 are affected in all firmware versions and have no vendor patch available.

Workarounds

Place affected devices on an isolated, tightly controlled management VLAN reachable only through a hardened jump host.
Restrict CLI and terminal access to a minimal set of trusted administrator accounts and enforce multi-factor authentication upstream.
Disable Telnet and any unauthenticated management protocols, and remove unused local accounts to shrink the authenticated attack surface.

bash

# Configuration example
# Restrict management access with an access list on upstream infrastructure
# Replace 10.10.0.0/24 with your administrator subnet
access-list MGMT permit tcp 10.10.0.0/24 host <lantronix-mgmt-ip> eq 22
access-list MGMT deny   ip any host <lantronix-mgmt-ip>