CVE-2026-80150: Lantronix SLC8000 SSRF Vulnerability

CVE-2026-80150 Overview

CVE-2026-80150 is a server-side request forgery (SSRF) vulnerability [CWE-918] affecting Lantronix out-of-band management devices. The flaw resides in the WebSSH/WebTelnet listener implemented by a custom shellinaboxd binary. The listener trusts the rooturl parameter supplied over the web connection to determine the target IP address for Telnet sessions. Unauthenticated attackers can modify this parameter to force the device to establish Telnet connections to arbitrary hosts on the internal network. Affected products include Lantronix SLC8000 before firmware v9.7.0.3, EMG8500 and EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882.

Critical Impact
Unauthenticated attackers can pivot through affected out-of-band management devices to enumerate and communicate with internal network endpoints that are otherwise unreachable from the internet.

Affected Products

Lantronix SLC8000 — firmware versions before v9.7.0.3
Lantronix EMG8500 and EMG7500 — firmware versions before v9.7.0.1
Lantronix SLB882 — all firmware versions

Discovery Timeline

2026-09-22 - CVE-2026-80150 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-80150

Vulnerability Analysis

The affected Lantronix devices ship a modified version of the open-source shellinaboxd daemon to provide browser-based Telnet and SSH access. In the vendor's customization, the daemon reads the rooturl query parameter from the incoming HTTP request and uses it to derive the destination address for the Telnet backend connection. No authentication is required to reach this endpoint, and the parameter is not validated against an allow-list of local interface addresses.

By substituting rooturl with an attacker-chosen host or IP, the attacker coerces the device to initiate outbound Telnet traffic to that target. The device performs the network request on the attacker's behalf, exposing hosts reachable from the management interface. See the VulnCheck Advisory on Lantronix SSRF and the Revrb Lantern Overview for the underlying research.

Root Cause

The root cause is improper input validation of a user-controlled URL parameter used as a network destination. The custom shellinaboxd treats the client-supplied rooturl value as authoritative for the device's own address, effectively delegating the connection target to any anonymous web client.

Attack Vector

Exploitation requires only network access to the device's WebSSH/WebTelnet listener. An attacker issues an HTTP request to the WebTelnet endpoint with the rooturl parameter set to an internal host and port. The device opens a Telnet connection to that host, and the resulting terminal stream is relayed back through the web session. This allows unauthenticated port and service enumeration against segments that are normally isolated from the attacker's network position.

Because SLC8000, EMG7500, EMG8500, and SLB882 are console servers deployed for out-of-band access, they typically bridge management VLANs and infrastructure networks, amplifying the reachable surface.

Detection Methods for CVE-2026-80150

Indicators of Compromise

HTTP requests to the WebSSH/WebTelnet endpoint on affected Lantronix devices containing a rooturl parameter that resolves to an address other than the device's own management IP.
Outbound Telnet (TCP/23) or arbitrary-port TCP connections originating from a Lantronix SLC8000, EMG7500, EMG8500, or SLB882 to internal hosts that are not managed serial endpoints.
Web access logs on the device showing unauthenticated requests to the shellinaboxd listener from untrusted source IPs.

Detection Strategies

Inspect HTTP traffic to the device's web interface for rooturl parameter values that deviate from expected local addresses.
Baseline the outbound connection patterns from console servers and alert on new destinations, particularly TCP/23 sessions to hosts outside the managed device inventory.
Correlate WebSSH/WebTelnet session initiation events with the source IP of the requesting client to identify anonymous or external initiators.

Monitoring Recommendations

Forward Lantronix device syslog and web access logs to a centralized analytics platform for retention and correlation.
Monitor management-network flow data (NetFlow, IPFIX, or sFlow) for lateral connections sourced from console servers.
Track firmware versions across the Lantronix fleet and alert on devices running versions earlier than v9.7.0.3 (SLC8000) or v9.7.0.1 (EMG7500/EMG8500), or any SLB882 firmware.

How to Mitigate CVE-2026-80150

Immediate Actions Required

Upgrade Lantronix SLC8000 to firmware v9.7.0.3 or later, and EMG7500/EMG8500 to firmware v9.7.0.1 or later.
Restrict access to the device web interface to a dedicated management network and block it from untrusted networks at the perimeter.
Retire or network-isolate SLB882 devices, as no fixed firmware is available.

Patch Information

Lantronix has published fixed firmware for the affected product lines. Firmware images are available from the vendor's support FTP site: Lantronix SLC8000 Firmware, Lantronix EMG 8500 Firmware, and Lantronix EMG 7500 Firmware. SLB882 does not have a vendor patch at the time of publication.

Workarounds

Disable the WebSSH/WebTelnet feature on affected devices if it is not required for operations.
Place affected devices behind a network access control list that only permits management traffic from a small, authenticated jump-host segment.
Segment the console-server management VLAN so that outbound Telnet traffic from the device to production networks is denied by default.

bash

# Example firewall policy restricting management access to Lantronix devices
# Replace addresses with your environment's jump-host and device management IPs
iptables -A FORWARD -s 10.10.5.0/24 -d 10.20.0.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.20.0.10 -p tcp --dport 443 -j DROP
iptables -A FORWARD -s 10.20.0.10 -p tcp --dport 23 -j DROP