CVE-2026-80149: Lantronix Device SSRF Vulnerability

CVE-2026-80149 Overview

CVE-2026-80149 is a Server-Side Request Forgery (SSRF) vulnerability affecting Lantronix autonomous out-of-band management devices. The flaw resides in the WebSSH/WebTelnet listener implemented by the custom shellinaboxd daemon. Unauthenticated attackers can manipulate the rooturl parameter to redirect SSH terminal connections from the device to arbitrary hosts. This turns the affected appliance into a pivot for reaching internal endpoints that would otherwise be unreachable from the internet. The vulnerability is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can coerce affected Lantronix devices to open SSH connections to arbitrary internal hosts, enabling network reconnaissance and interaction with otherwise isolated systems.

Affected Products

Lantronix SLC8000 before firmware v9.7.0.3
Lantronix EMG8500 and EMG7500 before firmware v9.7.0.1
Lantronix SLB882 (all firmware versions)

Discovery Timeline

2026-09-22 - CVE-2026-80149 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-80149

Vulnerability Analysis

The affected Lantronix devices provide browser-based SSH and Telnet access through a customized version of shellinaboxd, a web-to-terminal gateway. During session initialization, the daemon reads the rooturl parameter supplied by the client to determine the address it should connect to when establishing the backend SSH terminal session. The parameter is not validated against the device's own identity or an allowlist of permitted targets. An unauthenticated remote attacker can submit a crafted request that sets rooturl to any reachable host and port. The device then initiates an outbound SSH connection to that destination on behalf of the attacker, forwarding the interactive session back through the web listener. Because the appliance sits inside the operational network as an out-of-band management concentrator, the outbound connection often reaches assets that are not exposed to the public internet.

Root Cause

The root cause is missing validation of user-controlled input in the shellinaboxd connection handler. The rooturl parameter is trusted as a self-reference for the device's own IP address, but it is used directly to select the SSH endpoint. This is a textbook [CWE-918] flaw in which server-side functionality follows an attacker-controlled URL without sanitization or restriction.

Attack Vector

Exploitation requires only network access to the device's web interface and no authentication or user interaction. An attacker sends an HTTP request to the WebSSH or WebTelnet endpoint with a modified rooturl value pointing to an internal IP address or an attacker-controlled endpoint. The device responds by opening the SSH channel to the target. Attackers can enumerate internal hosts, fingerprint SSH banners, interact with services listening on internal ports, or coerce the device into speaking to attacker-controlled infrastructure. Technical detail is available in the VulnCheck Advisory on Lantronix and the Revrb Lantern Overview.

Detection Methods for CVE-2026-80149

Indicators of Compromise

Outbound SSH connections originating from Lantronix SLC8000, EMG8500, EMG7500, or SLB882 devices to unexpected internal or external hosts.
HTTP requests to the WebSSH or WebTelnet endpoints containing a rooturl parameter that references an address other than the device itself.
Unusual shellinaboxd process activity or high volumes of short-lived SSH sessions from a management appliance.

Detection Strategies

Inspect web access logs on affected appliances for requests where the rooturl query parameter deviates from the device's own IP or hostname.
Correlate network flow records to identify SSH traffic sourced from out-of-band management devices to non-administrative hosts.
Alert on any SSH connection from a Lantronix appliance to an external IP address, which should not occur in normal operation.

Monitoring Recommendations

Baseline expected outbound destinations for each Lantronix appliance and alert on deviations.
Forward device syslog and web listener logs to a centralized SIEM for long-term retention and correlation.
Monitor for repeated failed SSH handshakes from the appliance, which may indicate internal network scanning attempts.

How to Mitigate CVE-2026-80149

Immediate Actions Required

Upgrade SLC8000 devices to firmware v9.7.0.3 or later using the Lantronix SLC8000 Firmware distribution.
Upgrade EMG8500 devices to firmware v9.7.0.1 or later from the Lantronix EMG 8500 Firmware directory.
Upgrade EMG7500 devices to firmware v9.7.0.1 or later from the Lantronix EMG 7500 Firmware directory.
Remove SLB882 devices from untrusted networks; no fixed firmware is available for this platform.

Patch Information

Lantronix has released fixed firmware for the SLC8000 (v9.7.0.3) and EMG8500/EMG7500 (v9.7.0.1) product lines. The SLB882 has no available fix at time of publication, and all firmware versions remain vulnerable. Review the VulnCheck Advisory on Lantronix for the authoritative fix matrix before deployment.

Workarounds

Restrict access to the WebSSH and WebTelnet listeners using network-layer access control lists, allowing only known administrator IP addresses.
Place affected devices on a dedicated management VLAN that cannot initiate SSH connections to production subnets.
Disable the WebSSH and WebTelnet features if browser-based terminal access is not required, and use native SSH clients instead.
For SLB882 deployments, decommission internet-exposed instances until vendor guidance is issued.

bash

# Example egress restriction on an upstream firewall
# Block outbound SSH from the Lantronix management subnet except to approved jump hosts
iptables -A FORWARD -s 10.10.20.0/24 -p tcp --dport 22 -d 10.10.30.5 -j ACCEPT
iptables -A FORWARD -s 10.10.20.0/24 -p tcp --dport 22 -j DROP