CVE-2026-80152

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.3 SLC9000 versions prior to 9.7.0.2 EMG8500/EMG7500 versions prior to 9.7.0.1 SLB882 (affected versions not specified) SLCx-03 (affected versions not specified) SLCx-02 (affected versions not specified)

Description Authenticated attackers with services permission can execute arbitrary shell commands as root via the terminal or CLI interface. This occurs because the set script schedule command passes unsanitized user input to a system() call, leading to command injection. Successful exploitation can result in a complete loss of confidentiality, integrity, and availability of the device and may impact downstream serial-attached devices.

Recommendations Update SLC8000 to firmware version 9.7.0.3 or later. Update SLC9000 to firmware version 9.7.0.2 or later. Update EMG8500/EMG7500 to firmware version 9.7.0.1 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability for SLB882, SLCx-03, and SLCx-02.