CVE-2026-80148: Lantronix SLC8000 SSRF Vulnerability

CVE-2026-80148 Overview

CVE-2026-80148 is a server-side request forgery (SSRF) vulnerability affecting Lantronix out-of-band management devices. The flaw resides in the WebSSH/WebTelnet listener implemented by a custom shellinaboxd build. Unauthenticated attackers can force the affected device to establish SSH connections to arbitrary attacker-controlled endpoints by supplying an overlong username. The issue impacts Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882. Because the vulnerable listener is reachable over the network without authentication, attackers can pivot from the device to enumerate internal hosts that would otherwise be unreachable [CWE-918].

Critical Impact
Unauthenticated attackers can coerce affected Lantronix devices into initiating SSH connections to arbitrary hosts, enabling internal network reconnaissance and communication with restricted endpoints.

Affected Products

Lantronix SLC8000 before firmware v9.7.0.3
Lantronix EMG8500 and EMG7500 before firmware v9.7.0.1
Lantronix SLB882 (all firmware versions)

Discovery Timeline

2026-09-22 - CVE-2026-80148 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-80148

Vulnerability Analysis

The vulnerability lives in the custom shellinaboxd binary that provides WebSSH and WebTelnet access on affected Lantronix appliances. When a browser session initiates an SSH connection, the listener builds the target host string using a fixed-size snprintf call that concatenates the user-supplied username with the device IP address. The output buffer is insufficient to hold arbitrarily long usernames, so the IP suffix is silently truncated when the username expands beyond the reserved space. An attacker who selects a username crafted to consume the buffer replaces the device IP with an attacker-controlled hostname, causing the SSH client to connect to an external or internal destination of the attacker's choosing. The listener does not require authentication, so any network-adjacent attacker who can reach the WebSSH endpoint can trigger this behavior.

Root Cause

The root cause is unsafe string composition in the SSH target-building routine. The snprintf invocation trusts user-controlled input for the username field without validating length, character set, or the semantic boundary between username and host. Truncation of the final host component causes the connection destination to shift from the intended loopback or device address to whatever segment remains after the buffer fills. This is a classic input validation failure that manifests as SSRF [CWE-918].

Attack Vector

Exploitation requires only network reach to the WebSSH/WebTelnet interface. An attacker submits an HTTP request to the listener containing a malicious username value long enough to push the intended IP suffix out of the composed target string. The device then initiates an outbound SSH connection to the attacker-designated host, which may be an external collector or an internal endpoint the attacker cannot otherwise reach. Because these appliances are frequently deployed as out-of-band console servers on management networks, the pivot enables reconnaissance of otherwise segmented infrastructure. Technical detail is available in the VulnCheck Advisory on Lantronix SSRF and the Revrb Lantern Overview.

Detection Methods for CVE-2026-80148

Indicators of Compromise

Outbound SSH connections (TCP/22) originating from Lantronix SLC8000, EMG8500, EMG7500, or SLB882 appliances to destinations outside the expected administrative scope.
HTTP requests to the WebSSH or WebTelnet listener containing unusually long username parameters.
Unexpected connection attempts from management-network devices to internal hosts that the appliance has no operational reason to reach.

Detection Strategies

Monitor NetFlow or firewall logs for SSH sessions initiated by Lantronix management devices and alert on destinations that fall outside an allowlist.
Inspect web server or proxy logs fronting the appliance for POST or GET requests to the WebSSH endpoint carrying oversized username fields.
Correlate device-originated SSH attempts with configuration changes or web sessions on the appliance to identify unauthorized use of the WebSSH feature.

Monitoring Recommendations

Baseline normal outbound connection patterns from console servers and generate alerts on deviations.
Forward Lantronix appliance syslog to a centralized platform and track WebSSH and WebTelnet session initiation events.
Enable egress logging on management-network firewalls to capture any external SSH traffic sourced from out-of-band devices.

How to Mitigate CVE-2026-80148

Immediate Actions Required

Upgrade Lantronix SLC8000 devices to firmware v9.7.0.3 or later using the Lantronix SLC8000 Firmware package.
Upgrade Lantronix EMG8500 and EMG7500 devices to firmware v9.7.0.1 or later via the Lantronix EMG 8500 Firmware and Lantronix EMG 7500 Firmware directories.
Restrict network access to the WebSSH and WebTelnet listener to trusted administrative subnets only.
For SLB882 devices, where no fixed firmware exists, disable WebSSH/WebTelnet or isolate the device behind strict egress filtering.

Patch Information

Lantronix has released fixed firmware for the SLC8000 (v9.7.0.3) and EMG8500/EMG7500 (v9.7.0.1) product lines. No fixed firmware has been published for the SLB882 platform, so compensating controls are required for those devices. Refer to the VulnCheck Advisory on Lantronix SSRF for complete vendor guidance.

Workarounds

Block outbound SSH from Lantronix appliances at the network firewall except to explicitly authorized targets.
Disable the WebSSH and WebTelnet features on affected devices where operational workflows permit.
Place affected appliances on an isolated management VLAN with strict ingress and egress access control lists.
Require VPN or bastion access before allowing administrators to reach the appliance web interface.