CVE-2026-80156: Lantronix Device Path Traversal Vulnerability

CVE-2026-80156 Overview

CVE-2026-80156 is a path traversal vulnerability [CWE-22] in the web management portal of several Lantronix autonomous out-of-band management devices. The upload endpoint strips backslash characters from filenames but fails to recheck for forward slashes after that transformation. Authenticated attackers can supply a crafted filename that combines both separators to write arbitrary data outside the intended upload directory. Successful exploitation leads to remote code execution on the affected device and can pivot to serial-connected downstream equipment.

Critical Impact
Authenticated attackers reachable over the network can write arbitrary files to any writable filesystem path, achieving remote code execution on out-of-band management appliances that typically sit at the top of infrastructure trust chains.

Affected Products

Lantronix SLC8000 before firmware v9.7.0.5
Lantronix EMG8500 and EMG7500 before firmware v9.7.0.1
Lantronix SLB882, SLCx-03, and SLCx-02 (all firmware versions)

Discovery Timeline

2026-09-21 - Technical write-up published by Revrb
2026-09-22 - CVE-2026-80156 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-80156

Vulnerability Analysis

The flaw resides in the filename validation logic used by the web management portal's upload endpoint. The routine sanitizes user-supplied filenames by removing backslash (\) characters, treating them as a Windows-style path separator that should never appear in an uploaded name. After stripping backslashes, the routine does not re-run its check for forward slashes (/), which are the actual path separator on the underlying Linux-based firmware.

An attacker who submits a filename containing both \ and / characters, along with .. traversal sequences, bypasses the intended containment. The web service writes attacker-controlled content to any writable path on the device filesystem. Because the web service runs with elevated privileges on the appliance, the write primitive translates directly into remote code execution through mechanisms such as replacing startup scripts, cron entries, or web content served by the same portal.

Exploitation requires an authenticated session, but out-of-band management consoles frequently share credentials across a fleet and are often reachable from management networks that adversaries target early in an intrusion.

Root Cause

The root cause is an ordering defect in input validation. The sanitizer transforms input by stripping one class of separator character but does not re-validate the transformed string. This pattern is a classic instance of [CWE-22] path traversal enabled by non-idempotent sanitization.

Attack Vector

An authenticated attacker sends an HTTP upload request to the web management portal with a crafted filename parameter such as \../../etc/init.d/payload. After the backslash is stripped, the residual ../../etc/init.d/payload traverses out of the upload directory. The server writes the request body to the attacker-selected path, which the attacker then triggers to obtain code execution as the web service user. See the Vulncheck advisory and the Revrb Lantern overview for a full protocol walkthrough.

Detection Methods for CVE-2026-80156

Indicators of Compromise

HTTP POST requests to the web management portal upload endpoint containing filenames with both \ and / characters or .. traversal sequences.
Unexpected file writes under system directories such as /etc/, /etc/init.d/, /usr/local/, or the web root outside of scheduled firmware updates.
New or modified startup scripts, cron entries, or web assets on SLC8000, EMG8500, EMG7500, SLB882, or SLCx-series appliances.
Outbound connections initiated by the appliance to unfamiliar hosts shortly after an administrative session.

Detection Strategies

Inspect web server and audit logs on affected appliances for upload requests whose filename field contains backslashes, forward slashes, or .. sequences.
Baseline the filesystem of representative devices and alert on writes outside the documented upload directory.
Correlate authenticated administrative sessions with subsequent process creation or configuration change events on the appliance.

Monitoring Recommendations

Forward appliance syslog, web access logs, and authentication events to a central analytics platform for longitudinal review.
Monitor management VLANs for HTTP traffic to Lantronix devices from hosts that are not designated administrative jump boxes.
Alert on repeated failed logins to the web portal that precede successful authentication, which may indicate credential reuse before exploitation.

How to Mitigate CVE-2026-80156

Immediate Actions Required

Upgrade SLC8000 devices to firmware v9.7.0.5 or later and EMG8500/EMG7500 devices to firmware v9.7.0.1 or later.
For SLB882, SLCx-03, and SLCx-02 devices, which have no fixed firmware, remove the web management portal from any network reachable by untrusted users and plan device replacement.
Rotate all administrative credentials on affected appliances and review recent audit logs for signs of arbitrary file writes.
Restrict management-plane access to a dedicated out-of-band network with strict allow-listing.

Patch Information

Lantronix has published fixed firmware for the supported product lines. Download images from the vendor firmware directories for SLC8000 9.7.0.5R2, EMG7500 9.7.0.1R2, and EMG8500 9.7.0.1R2. No patch is available for SLB882, SLCx-03, or SLCx-02; these lines remain vulnerable in all firmware versions.

Workarounds

Place affected devices behind a jump host or VPN concentrator so the web management portal is unreachable from general-purpose networks.
Disable the web management interface where the command-line or serial console is sufficient for administration.
Enforce network access control lists that permit HTTP/HTTPS to management ports only from a small set of authorized administrator workstations.
Increase authentication assurance by rotating credentials, enforcing unique per-device passwords, and integrating with centralized authentication where supported.