CVE-2026-80149

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.3 SLC9000 versions prior to 9.7.0.2 EMG8500/EMG7500 versions prior to 9.7.0.1 SLB882 (affected versions not specified)

Description A server-side request forgery (SSRF) issue exists in the WebSSH/WebTelnet listener. This allows unauthenticated attackers to force the device to establish SSH connections to external endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter, an attacker can redirect the SSH terminal connection to an arbitrary host or IP. This capability can be used to enumerate or communicate with internal network endpoints that are otherwise inaccessible.

Recommendations Update SLC8000 to firmware v9.7.0.3 or later. Update SLC9000 to firmware v9.7.0.2 or later. Update EMG8500/EMG7500 to firmware v9.7.0.1 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability for SLB882.