CVE-2026-80145

Name of the Vulnerable Software and Affected Versions Lantronix SLC8000 versions prior to 9.7.0.2 Lantronix EMG8500 versions prior to 9.7.0.1 Lantronix EMG7500 versions prior to 9.7.0.1 Lantronix SLB882 (affected versions not specified) Lantronix SLCx-03 (affected versions not specified) Lantronix SLCx-02 (affected versions not specified)

Description Authenticated attackers with services permission can execute arbitrary shell commands as root via the terminal or CLI interface. This occurs because the set cifs password command passes unsanitized user input to a system() call, leading to command injection. Successful exploitation can result in a complete loss of confidentiality, integrity, and availability of the device and may impact downstream serial-attached devices.

Recommendations Update SLC8000 to firmware version 9.7.0.2 or later. Update EMG8500 to firmware version 9.7.0.1 or later. Update EMG7500 to firmware version 9.7.0.1 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability for SLB882, SLCx-03, and SLCx-02.