Search
Find a vulnerability
Search criteria
53 vulnerabilities by LANTRONIX
CVE-2026-80156 (GCVE-0-2026-80156)
Vulnerability from nvd – Published: 2026-09-22 15:23 – Updated: 2026-09-24 19:11
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass
Summary
Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device's filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 15:42 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.5
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T15:42:01.037508Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:42:10.927Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device\u0027s filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:11:50.183Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-arbitrary-file-write-via-upload-filename-validation-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80156",
"datePublished": "2026-09-22T15:23:24.784Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-24T19:11:50.183Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80155 (GCVE-0-2026-80155)
Vulnerability from nvd – Published: 2026-09-22 15:22 – Updated: 2026-09-24 19:11
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation
Summary
Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:42 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.5
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80155",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:42:37.923706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:43:00.393Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:11:02.375Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-unauthenticated-authentication-bypass-via-snprintf-path-truncation"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80155",
"datePublished": "2026-09-22T15:22:57.059Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-24T19:11:02.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80154 (GCVE-0-2026-80154)
Vulnerability from nvd – Published: 2026-09-22 15:22 – Updated: 2026-09-24 19:10
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass
Summary
All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:31.916185Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:14.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:10:15.088Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-predictable-session-token-with-validation-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80154",
"datePublished": "2026-09-22T15:22:33.748Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-24T19:10:15.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80152 (GCVE-0-2026-80152)
Vulnerability from nvd – Published: 2026-09-22 15:22 – Updated: 2026-09-26 13:29
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule
Summary
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set script schedule command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:49 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.3
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:49:36.568082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:52:24.941Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set script schedule command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T13:29:54.538Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-os-command-injection-via-set-script-schedule"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80152",
"datePublished": "2026-09-22T15:22:09.965Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-26T13:29:54.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80151 (GCVE-0-2026-80151)
Vulnerability from nvd – Published: 2026-09-22 15:21 – Updated: 2026-09-26 13:29
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download
Summary
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set nfs download command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 23:35 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.3
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T23:35:00.564701Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T23:35:17.426Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set nfs download command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T13:29:53.855Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-os-command-injection-via-set-nfs-download"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80151",
"datePublished": "2026-09-22T15:21:45.246Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-26T13:29:53.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80150 (GCVE-0-2026-80150)
Vulnerability from nvd – Published: 2026-09-22 15:21 – Updated: 2026-09-26 13:29
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter
Summary
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 15:46 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80150",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T15:46:31.921852Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:46:38.366Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T13:29:53.179Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webtelnet-ssrf-via-rooturl-parameter"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80150",
"datePublished": "2026-09-22T15:21:22.223Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-26T13:29:53.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80149 (GCVE-0-2026-80149)
Vulnerability from nvd – Published: 2026-09-22 15:20 – Updated: 2026-09-26 13:29
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter
Summary
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:41 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:41:42.950532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:42:08.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T13:29:52.466Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-rooturl-parameter"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80149",
"datePublished": "2026-09-22T15:20:57.823Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-26T13:29:52.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80148 (GCVE-0-2026-80148)
Vulnerability from nvd – Published: 2026-09-22 15:20 – Updated: 2026-09-26 13:29
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation
Summary
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80148",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:22.576164Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:20.907Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T13:29:51.780Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-username-truncation"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80148",
"datePublished": "2026-09-22T15:20:33.864Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-26T13:29:51.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80147 (GCVE-0-2026-80147)
Vulnerability from nvd – Published: 2026-09-22 15:20 – Updated: 2026-09-24 19:04
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write
Summary
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 16:02 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.2
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80147",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T16:02:05.783698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T16:04:04.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:04:09.218Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-stack-based-buffer-overflow-via-mfc-eeprom-write"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80147",
"datePublished": "2026-09-22T15:20:01.691Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-24T19:04:09.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80146 (GCVE-0-2026-80146)
Vulnerability from nvd – Published: 2026-09-22 15:19 – Updated: 2026-09-25 23:34
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read
Summary
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 23:33 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.2
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80146",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T23:33:56.909340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T23:34:09.518Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:03:26.826Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-stack-based-buffer-overflow-via-mfc-eeprom-read"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80146",
"datePublished": "2026-09-22T15:19:38.818Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-25T23:34:09.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80145 (GCVE-0-2026-80145)
Vulnerability from nvd – Published: 2026-09-22 15:18 – Updated: 2026-09-24 19:02
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password
Summary
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 15:47 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.2
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80145",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T15:47:50.948392Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:47:57.416Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:02:15.483Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-set-cifs-password"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80145",
"datePublished": "2026-09-22T15:18:34.859Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-24T19:02:15.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80144 (GCVE-0-2026-80144)
Vulnerability from nvd – Published: 2026-09-22 15:17 – Updated: 2026-09-24 19:02
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write
Summary
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:43 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.2
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80144",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:43:42.780303Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:43:55.512Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:02:33.612Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-mfc-eeprom-write"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80144",
"datePublished": "2026-09-22T15:17:45.543Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-24T19:02:33.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80143 (GCVE-0-2026-80143)
Vulnerability from nvd – Published: 2026-09-22 15:17 – Updated: 2026-09-24 19:02
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read
Summary
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.2
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:12.191184Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:26.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:02:44.035Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-mfc-eeprom-read"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80143",
"datePublished": "2026-09-22T15:17:21.739Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-24T19:02:44.035Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7766 (GCVE-0-2025-7766)
Vulnerability from nvd – Published: 2025-07-22 21:44 – Updated: 2025-07-23 19:57
VLAI
EPSS
VEX
Title
Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference
Summary
Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-23 19:57 UTC
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lantronix | Provisioning Manager |
Affected:
0 , ≤ 7.10.2
(custom)
|
Date Public
2025-07-22 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-7766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-23T19:57:44.156874Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-23T19:57:57.931Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Provisioning Manager",
"vendor": "Lantronix",
"versions": [
{
"lessThanOrEqual": "7.10.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Robert McLellan reported this vulnerability to CISA."
}
],
"datePublic": "2025-07-22T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eLantronix\u0026nbsp;Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.\u003c/span\u003e"
}
],
"value": "Lantronix\u00a0Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-22T21:44:10.227Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-02"
},
{
"url": "https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eLantronix has provided a fix and recommends users update to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM\"\u003ev7.10.4\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;or later.\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "Lantronix has provided a fix and recommends users update to v7.10.4 https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM \u00a0or later."
}
],
"source": {
"advisory": "ICSA-25-203-02",
"discovery": "EXTERNAL"
},
"title": "Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-7766",
"datePublished": "2025-07-22T21:44:10.227Z",
"dateReserved": "2025-07-17T14:41:27.079Z",
"dateUpdated": "2025-07-23T19:57:57.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-80156 (GCVE-0-2026-80156)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:23 – Updated: 2026-09-24 19:11
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass
Summary
Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device's filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 15:42 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.5
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T15:42:01.037508Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:42:10.927Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device\u0027s filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:11:50.183Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-arbitrary-file-write-via-upload-filename-validation-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80156",
"datePublished": "2026-09-22T15:23:24.784Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-24T19:11:50.183Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80155 (GCVE-0-2026-80155)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:22 – Updated: 2026-09-24 19:11
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation
Summary
Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:42 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.5
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80155",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:42:37.923706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:43:00.393Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:11:02.375Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-unauthenticated-authentication-bypass-via-snprintf-path-truncation"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80155",
"datePublished": "2026-09-22T15:22:57.059Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-24T19:11:02.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80154 (GCVE-0-2026-80154)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:22 – Updated: 2026-09-24 19:10
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass
Summary
All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:31.916185Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:14.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:10:15.088Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-predictable-session-token-with-validation-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80154",
"datePublished": "2026-09-22T15:22:33.748Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-24T19:10:15.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80152 (GCVE-0-2026-80152)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:22 – Updated: 2026-09-26 13:29
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule
Summary
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set script schedule command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:49 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.3
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:49:36.568082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:52:24.941Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set script schedule command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T13:29:54.538Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-os-command-injection-via-set-script-schedule"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80152",
"datePublished": "2026-09-22T15:22:09.965Z",
"dateReserved": "2026-08-25T20:43:54.262Z",
"dateUpdated": "2026-09-26T13:29:54.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80151 (GCVE-0-2026-80151)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:21 – Updated: 2026-09-26 13:29
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download
Summary
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set nfs download command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 23:35 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.3
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T23:35:00.564701Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T23:35:17.426Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set nfs download command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T13:29:53.855Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-os-command-injection-via-set-nfs-download"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80151",
"datePublished": "2026-09-22T15:21:45.246Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-26T13:29:53.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80150 (GCVE-0-2026-80150)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:21 – Updated: 2026-09-26 13:29
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter
Summary
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 15:46 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80150",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T15:46:31.921852Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:46:38.366Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T13:29:53.179Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webtelnet-ssrf-via-rooturl-parameter"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80150",
"datePublished": "2026-09-22T15:21:22.223Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-26T13:29:53.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80149 (GCVE-0-2026-80149)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:20 – Updated: 2026-09-26 13:29
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter
Summary
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:41 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:41:42.950532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:42:08.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T13:29:52.466Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-rooturl-parameter"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80149",
"datePublished": "2026-09-22T15:20:57.823Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-26T13:29:52.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80148 (GCVE-0-2026-80148)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:20 – Updated: 2026-09-26 13:29
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation
Summary
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80148",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:22.576164Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:20.907Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-26T13:29:51.780Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-username-truncation"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80148",
"datePublished": "2026-09-22T15:20:33.864Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-26T13:29:51.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80147 (GCVE-0-2026-80147)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:20 – Updated: 2026-09-24 19:04
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write
Summary
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 16:02 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.2
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80147",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T16:02:05.783698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T16:04:04.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:04:09.218Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-stack-based-buffer-overflow-via-mfc-eeprom-write"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80147",
"datePublished": "2026-09-22T15:20:01.691Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-24T19:04:09.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80146 (GCVE-0-2026-80146)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:19 – Updated: 2026-09-25 23:34
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read
Summary
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 23:33 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.2
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80146",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T23:33:56.909340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T23:34:09.518Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:03:26.826Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-stack-based-buffer-overflow-via-mfc-eeprom-read"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80146",
"datePublished": "2026-09-22T15:19:38.818Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-25T23:34:09.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80145 (GCVE-0-2026-80145)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:18 – Updated: 2026-09-24 19:02
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password
Summary
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 15:47 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.2
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80145",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T15:47:50.948392Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:47:57.416Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:02:15.483Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-set-cifs-password"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80145",
"datePublished": "2026-09-22T15:18:34.859Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-24T19:02:15.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80144 (GCVE-0-2026-80144)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:17 – Updated: 2026-09-24 19:02
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write
Summary
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:43 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.2
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80144",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:43:42.780303Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:43:55.512Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:02:33.612Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-mfc-eeprom-write"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80144",
"datePublished": "2026-09-22T15:17:45.543Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-24T19:02:33.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80143 (GCVE-0-2026-80143)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:17 – Updated: 2026-09-24 19:02
VLAI
EPSS
VEX
Title
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read
Summary
Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 17:22 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://revrb.net/2026/09/21/revrb-lantern.html | technical-description |
| https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ | patch |
| https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/ | patch |
| https://www.vulncheck.com/advisories/lantronix-au… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| LANTRONIX | SLC8000 |
Affected:
0 , < 9.7.0.2
(custom)
|
|
| LANTRONIX | EMG8500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | EMG7500 |
Affected:
0 , < 9.7.0.1
(custom)
|
|
| LANTRONIX | SLB882 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-03 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLCx-02 |
Affected:
*
(custom)
|
|
| LANTRONIX | SLC9000 |
Affected:
0 , < 9.7.0.2
(custom)
|
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T17:22:12.191184Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:44:26.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SLC8000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG8500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMG7500",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLB882",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SLCx-03",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLCx-02",
"vendor": "LANTRONIX",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SLC9000",
"vendor": "LANTRONIX",
"versions": [
{
"lessThan": "9.7.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "RE/VRb"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:02:44.035Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description"
],
"url": "https://revrb.net/2026/09/21/revrb-lantern.html"
},
{
"name": "SLC8000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/"
},
{
"name": "EMG8500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
},
{
"name": "EMG7500 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
},
{
"name": "SLC9000 Firmware",
"tags": [
"patch"
],
"url": "https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-mfc-eeprom-read"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80143",
"datePublished": "2026-09-22T15:17:21.739Z",
"dateReserved": "2026-08-25T20:43:54.261Z",
"dateUpdated": "2026-09-24T19:02:44.035Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7766 (GCVE-0-2025-7766)
Vulnerability from cvelistv5 – Published: 2025-07-22 21:44 – Updated: 2025-07-23 19:57
VLAI
EPSS
VEX
Title
Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference
Summary
Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-23 19:57 UTC
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lantronix | Provisioning Manager |
Affected:
0 , ≤ 7.10.2
(custom)
|
Date Public
2025-07-22 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-7766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-23T19:57:44.156874Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-23T19:57:57.931Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Provisioning Manager",
"vendor": "Lantronix",
"versions": [
{
"lessThanOrEqual": "7.10.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Robert McLellan reported this vulnerability to CISA."
}
],
"datePublic": "2025-07-22T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eLantronix\u0026nbsp;Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.\u003c/span\u003e"
}
],
"value": "Lantronix\u00a0Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-22T21:44:10.227Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-02"
},
{
"url": "https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eLantronix has provided a fix and recommends users update to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM\"\u003ev7.10.4\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;or later.\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "Lantronix has provided a fix and recommends users update to v7.10.4 https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM \u00a0or later."
}
],
"source": {
"advisory": "ICSA-25-203-02",
"discovery": "EXTERNAL"
},
"title": "Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-7766",
"datePublished": "2025-07-22T21:44:10.227Z",
"dateReserved": "2025-07-17T14:41:27.079Z",
"dateUpdated": "2025-07-23T19:57:57.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GCVE-1988-2026-0165
Vulnerability from gna-1988 – Published: 2026-09-07 13:35 – Updated: 2026-09-11 11:56
VLAI
EPSS
VEX
Title
[0day-rubbish] Lantronix EDS3000PR 3.2.0.0R2 two vulnerabilities
Summary
0day Rubbish Research Team is publicly disclosing two vulnerabilities in Lantronix EDS3000PR 3.2.0.0R2.
Vulnerability 1 — Authenticated command injection to root RCE in FsUnmount (CVSS 8.8,
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78)
Lantronix EDS3000PR is an industrial serial device server (CII/OT). Its FsUnmount page handler validates a
user-supplied path against a character bitmask that rejects most shell metacharacters but allows single quotes and
newlines, then executes /sbin/ltrx_usb_umount '/ltrx_user<path>' via /bin/sh -c. A newline breaks out of the
single-quoted command and the injected command executes as root. Verified with a root-owned marker in a qemu-arm chroot
using the real rootfs /bin/sh.
Authentication: authenticated (requires valid session)
Vulnerability 2 — Authenticated command injection to root RCE in SSL certificate import and diagnostics (CVSS 8.8,
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78)
On the same Lantronix EDS3000PR device, the SSL certificate upload handler builds openssl rsa|dsa|ec|pkcs12 -passin
pass:%s commands from the attacker-controlled certificate password and executes them via system(); the diagnostics
handler builds ping and traceroute commands from the attacker-controlled host field the same way. No shell-character
sanitization exists. An authenticated admin submits a semicolon or command-substitution payload in the password or host
field; the injected command executes as root. Verified with root markers for 5/5 SSL vectors and 3/3 diagnostics
vectors.
Authentication: authenticated (requires valid session)
Full technical analyses and reproducible proofs-of-concept:
https://0day-rubbish.com/blog/lantronix-eds3000pr-fsunmount-command-injection
https://0day-rubbish.com/blog/lantronix-eds3000pr-passin-pass-command-injection
Project archive (ongoing disclosure series):
https://github.com/Exploit-Garbage/0day-Rubbish
Vendor has been notified. CVE IDs are pending.
--
0day Rubbish Research Team
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
8 references
{
"containers": {
"cna": {
"affected": [
{
"product": "EDS3000PR",
"vendor": "Lantronix",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "0day Rubbish Research Team is publicly disclosing two vulnerabilities in Lantronix EDS3000PR 3.2.0.0R2.\n\nVulnerability 1 \u2014 Authenticated command injection to root RCE in FsUnmount (CVSS 8.8, \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78)\n\nLantronix EDS3000PR is an industrial serial device server (CII/OT). Its FsUnmount page handler validates a \nuser-supplied path against a character bitmask that rejects most shell metacharacters but allows single quotes and \nnewlines, then executes /sbin/ltrx_usb_umount \u0027/ltrx_user\u003cpath\u003e\u0027 via /bin/sh -c. A newline breaks out of the \nsingle-quoted command and the injected command executes as root. Verified with a root-owned marker in a qemu-arm chroot \nusing the real rootfs /bin/sh.\n\nAuthentication: authenticated (requires valid session)\n\nVulnerability 2 \u2014 Authenticated command injection to root RCE in SSL certificate import and diagnostics (CVSS 8.8, \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78)\n\nOn the same Lantronix EDS3000PR device, the SSL certificate upload handler builds openssl rsa|dsa|ec|pkcs12 -passin \npass:%s commands from the attacker-controlled certificate password and executes them via system(); the diagnostics \nhandler builds ping and traceroute commands from the attacker-controlled host field the same way. No shell-character \nsanitization exists. An authenticated admin submits a semicolon or command-substitution payload in the password or host \nfield; the injected command executes as root. Verified with root markers for 5/5 SSL vectors and 3/3 diagnostics \nvectors.\n\nAuthentication: authenticated (requires valid session)\n\nFull technical analyses and reproducible proofs-of-concept:\n https://0day-rubbish.com/blog/lantronix-eds3000pr-fsunmount-command-injection\n https://0day-rubbish.com/blog/lantronix-eds3000pr-passin-pass-command-injection\n\nProject archive (ongoing disclosure series):\n https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE IDs are pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:56:33Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/6"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/6"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/lantronix-eds3000pr-fsunmount-command-injection"
},
{
"url": "https://0day-rubbish.com/blog/lantronix-eds3000pr-passin-pass-command-injection"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/6"
],
"discovery": "EXTERNAL"
},
"title": "[0day-rubbish] Lantronix EDS3000PR 3.2.0.0R2 two vulnerabilities",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0165",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/6",
"automated": true,
"contentSha256": "06ba7fc5d15136ee62ee34cb74db1c10b234c3b66a7cb5d42fb6f500d9dc4431",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/6",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T15:10:49Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:35:56Z",
"dateUpdated": "2026-09-11T11:56:33Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0165"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
VAR-200202-0006
Vulnerability from variot - Updated: 2026-04-10 23:59Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. Multiple vendor SNMPv1 Trap handling implementations contain vulnerabilities that may allow unauthorized privileged access, denial-of-service conditions, or unstable behavior . If your site uses SNMP in any capacity, the CERT/CC encourages you to read the information provided below. ------------ This vulnerability information is a summary of multiple vulnerabilities released at the same time. Please note that the contents of vulnerability information other than the title are included. ------------ SNMP Protocol is status and performance information MIB (Management Information Base) Protocol used to exchange Management side SNMP Managers such as managed routers, switches and printers SNMP Communicates with management network devices called agents. Because of its wide acceptance in the market, SNMP Has become the standard for SNMP protocol version1 Is SNMPv1 Is the most widely implemented. this SNMPv1 Sent from the agent to the manager in the implementation of SNMP Trap message and sent from the manager to the agent SNMP Decrypt the request message / There are problems in interpreting. If this problem is used by an attacker, the following actions may be executed. Many other programs that you implement may also be affected because of a protocol problem. On the target host SNMP If the service is running, an attacker could execute arbitrary code ・ If a buffer overflow attack is feasible and a very long trap message SNMP If the host on which the service is running receives, the application may go into a denial of service state The effects described above vary from application to application. For details, refer to each product.Please refer to the “Overview” for the impact of this vulnerability. Windows 95 is prone to a denial-of-service vulnerability. MPE/iX is an Internet-ready operating system for the HP e3000 class servers. It is possible to crash the service by transmitting to it a maliciously constructed SNMPv1 request PDU. It was previously known as UCD-SNMP. They typically notify the manager that some event has occured or otherwise provide information about the status of the agent. Multiple vulnerabilities have been discovered in a number of SNMP implementations. The vulnerabilities are known to exist in the process of decoding and interpreting SNMP trap messages. Among the possible consequences are denial of service and allowing attackers to compromise target systems. These depend on the individual vulnerabilities in each affected product. HP has confirmed that large traps will cause OpenView Network Node Manager to crash. This may be due to an exploitable buffer overflow condition
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "3com",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "adtran",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "adventnet",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "american power conversion",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "aprisma",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "avaya",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "bea",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "bmc",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "cnt",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "comtek services",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "cscare",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "cacheflow",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "carrier access",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "cisco",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "compaq computer",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "computer associates",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "concord",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "dart",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "dell",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "digital",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "entrada",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "equinox",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "f5",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "fluke",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "freebsd",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "general datacomm",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "hewlett packard",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "hirschmann",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "hitachi",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "ibm",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "iplanet",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "itouch",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "infovista",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "inktomi",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "innerdive",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "ipswitch",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "juniper",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "karlnet",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "lantronix",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "larscom incorporated",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "lotus",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "lucent",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "mg soft",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "mandriva",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "marconi",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "mercury interactive",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "metrobility optical",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "micromuse",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "microsoft",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "monfox",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "multinet",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "nec",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "net snmp",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "network harmoni",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "nbase xyplex",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "netscout",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "netsilicon",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "netscape",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "network appliance",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "nortel",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "novell",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "openwave",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "optical access",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "oracle",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "perle",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "powerware",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "radware",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "red hat",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "redback",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "riverstone",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "snmp research",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "sniffer",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "sonicwall",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "sonus",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "stonesoft",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "sun microsystems",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "symantec",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "the sco group sco unix",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "tivoli",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "toshiba",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "unisphere",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "vertical",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "vina",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "wind river",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "world wide packets",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "xerox",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "e security",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 1.6,
"vendor": "net com",
"version": null
},
{
"_id": null,
"model": "aix",
"scope": "eq",
"trust": 1.1,
"vendor": "ibm",
"version": "4.3"
},
{
"_id": null,
"model": "aix",
"scope": "eq",
"trust": 1.1,
"vendor": "ibm",
"version": "5.1"
},
{
"_id": null,
"model": "snmp",
"scope": "eq",
"trust": 1.0,
"vendor": "snmp",
"version": "*"
},
{
"_id": null,
"model": "windows 98se",
"scope": null,
"trust": 0.9,
"vendor": "microsoft",
"version": null
},
{
"_id": null,
"model": "windows",
"scope": "eq",
"trust": 0.9,
"vendor": "microsoft",
"version": "95"
},
{
"_id": null,
"model": "windows server",
"scope": "eq",
"trust": 0.9,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nudesign team",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "outback resource group",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "veritas",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "bintec",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "interniche",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ncipher corp",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "netscreen",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nokia",
"version": null
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "2.6 (sparc)"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "2.6 (x86)"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "7.0 (sparc)"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "7.0 (x86)"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "8 (sparc)"
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "8 (x86)"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "10.00"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "10.10"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "10.20"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "11.00"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "11.11"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "11.20"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "10.24"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "11.04"
},
{
"_id": null,
"model": "windows 2000",
"scope": null,
"trust": 0.8,
"vendor": "microsoft",
"version": null
},
{
"_id": null,
"model": "windows 9x",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "95"
},
{
"_id": null,
"model": "windows 9x",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "98"
},
{
"_id": null,
"model": "windows 9x",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "98 scd"
},
{
"_id": null,
"model": "windows 9x",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "me"
},
{
"_id": null,
"model": "windows nt",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "4.0 (server)"
},
{
"_id": null,
"model": "windows nt",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "4.0 (terminal_srv)"
},
{
"_id": null,
"model": "windows nt",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "4.0 (workstation)"
},
{
"_id": null,
"model": "windows xp",
"scope": "eq",
"trust": 0.8,
"vendor": "microsoft",
"version": "sp3"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6.2"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "7.0"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "7.1"
},
{
"_id": null,
"model": "linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "7.2"
},
{
"_id": null,
"model": "windows xp gold",
"scope": "eq",
"trust": 0.6,
"vendor": "microsoft",
"version": "0"
},
{
"_id": null,
"model": "windows nt",
"scope": "eq",
"trust": 0.6,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "mpe/ix",
"scope": "eq",
"trust": 0.6,
"vendor": "hp",
"version": "6.5"
},
{
"_id": null,
"model": "mpe/ix",
"scope": "eq",
"trust": 0.6,
"vendor": "hp",
"version": "6.0"
},
{
"_id": null,
"model": "mpe/ix",
"scope": "eq",
"trust": 0.6,
"vendor": "hp",
"version": "5.5"
},
{
"_id": null,
"model": "mpe/ix",
"scope": "eq",
"trust": 0.6,
"vendor": "hp",
"version": "5.0"
},
{
"_id": null,
"model": "mpe/ix",
"scope": "eq",
"trust": 0.6,
"vendor": "hp",
"version": "4.5"
},
{
"_id": null,
"model": "mpe/ix",
"scope": "eq",
"trust": 0.6,
"vendor": "hp",
"version": "4.0"
},
{
"_id": null,
"model": "ucd-snmp",
"scope": "eq",
"trust": 0.6,
"vendor": "net snmp",
"version": "4.2.1"
},
{
"_id": null,
"model": "ucd-snmp",
"scope": "eq",
"trust": 0.6,
"vendor": "net snmp",
"version": "4.1.1"
},
{
"_id": null,
"model": "ucd-snmp",
"scope": "ne",
"trust": 0.6,
"vendor": "net snmp",
"version": "4.2.2"
},
{
"_id": null,
"model": "snmp",
"scope": null,
"trust": 0.6,
"vendor": "snmp",
"version": null
},
{
"_id": null,
"model": "mpe/ix",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "7.0"
},
{
"_id": null,
"model": "sunatm",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "5.0"
},
{
"_id": null,
"model": "sunatm",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "4.0.1"
},
{
"_id": null,
"model": "sunatm",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "3.0.1"
},
{
"_id": null,
"model": "sunatm",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "2.1"
},
{
"_id": null,
"model": "ucd-snmp",
"scope": "eq",
"trust": 0.3,
"vendor": "net snmp",
"version": "4.1.2"
},
{
"_id": null,
"model": "ucd-snmp",
"scope": "ne",
"trust": 0.3,
"vendor": "net snmp",
"version": "4.2.3"
},
{
"_id": null,
"model": "solaris 8 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"_id": null,
"model": "solaris 8 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"_id": null,
"model": "solaris 7.0 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "7.0"
},
{
"_id": null,
"model": "solaris 2.6 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"_id": null,
"model": "solaris",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "2.6"
},
{
"_id": null,
"model": "enterprise server ssp",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "100003.5"
},
{
"_id": null,
"model": "enterprise server ssp",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "100003.4"
},
{
"_id": null,
"model": "enterprise server ssp",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "100003.3"
},
{
"_id": null,
"model": "research mid-level manager",
"scope": "eq",
"trust": 0.3,
"vendor": "snmp",
"version": "15.3"
},
{
"_id": null,
"model": "research enterpol",
"scope": "eq",
"trust": 0.3,
"vendor": "snmp",
"version": "15.3"
},
{
"_id": null,
"model": "research dr-web manager",
"scope": "eq",
"trust": 0.3,
"vendor": "snmp",
"version": "15.3"
},
{
"_id": null,
"model": "brocade",
"scope": "eq",
"trust": 0.3,
"vendor": "sgi",
"version": "2.6.0"
},
{
"_id": null,
"model": "networks aos",
"scope": null,
"trust": 0.3,
"vendor": "redback",
"version": null
},
{
"_id": null,
"model": "realplayer intranet",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "5.0"
},
{
"_id": null,
"model": "software tcpware",
"scope": "eq",
"trust": 0.3,
"vendor": "process",
"version": "5.5"
},
{
"_id": null,
"model": "software multinet",
"scope": "eq",
"trust": 0.3,
"vendor": "process",
"version": "4.4"
},
{
"_id": null,
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "9.0.1"
},
{
"_id": null,
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "2.2"
},
{
"_id": null,
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "2.1"
},
{
"_id": null,
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "2.0"
},
{
"_id": null,
"model": "enterprise manager",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "1.6.5"
},
{
"_id": null,
"model": "netware",
"scope": "eq",
"trust": 0.3,
"vendor": "novell",
"version": "6.0"
},
{
"_id": null,
"model": "netware",
"scope": "eq",
"trust": 0.3,
"vendor": "novell",
"version": "5.1"
},
{
"_id": null,
"model": "netware",
"scope": "eq",
"trust": 0.3,
"vendor": "novell",
"version": "5.0"
},
{
"_id": null,
"model": "netware",
"scope": "eq",
"trust": 0.3,
"vendor": "novell",
"version": "4.11"
},
{
"_id": null,
"model": "netware",
"scope": "eq",
"trust": 0.3,
"vendor": "novell",
"version": "4.2"
},
{
"_id": null,
"model": "netware",
"scope": "eq",
"trust": 0.3,
"vendor": "novell",
"version": "4.0"
},
{
"_id": null,
"model": "windows xp professional",
"scope": null,
"trust": 0.3,
"vendor": "microsoft",
"version": null
},
{
"_id": null,
"model": "windows xp home",
"scope": null,
"trust": 0.3,
"vendor": "microsoft",
"version": null
},
{
"_id": null,
"model": "windows nt workstation sp6a",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt workstation sp6",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt workstation sp5",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt workstation sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt workstation sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt workstation sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt workstation sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt terminal server sp6",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt terminal server sp5",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt terminal server sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt terminal server sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt terminal server sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt terminal server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt terminal server",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt server sp6a",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt server sp6",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt server sp5",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt server sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt server sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt server sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt server",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt enterprise server sp6a",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt enterprise server sp6",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt enterprise server sp5",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt enterprise server sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt enterprise server sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt enterprise server sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt enterprise server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows nt enterprise server",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "4.0"
},
{
"_id": null,
"model": "windows",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "98"
},
{
"_id": null,
"model": "windows terminal services sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows terminal services sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows terminal services",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows server sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows professional sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows professional sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows professional",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows datacenter server sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows datacenter server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows datacenter server",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows advanced server sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows advanced server sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "windows advanced server",
"scope": "eq",
"trust": 0.3,
"vendor": "microsoft",
"version": "2000"
},
{
"_id": null,
"model": "domino snmp agents solaris",
"scope": "eq",
"trust": 0.3,
"vendor": "lotus",
"version": "5.0.1x86"
},
{
"_id": null,
"model": "domino snmp agents solaris sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "lotus",
"version": "5.0.1"
},
{
"_id": null,
"model": "domino snmp agents hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "lotus",
"version": "5.0.1"
},
{
"_id": null,
"model": "lrs",
"scope": null,
"trust": 0.3,
"vendor": "lantronix",
"version": null
},
{
"_id": null,
"model": "junos",
"scope": "eq",
"trust": 0.3,
"vendor": "juniper",
"version": "5.0"
},
{
"_id": null,
"model": "solutions router ip console",
"scope": "eq",
"trust": 0.3,
"vendor": "innerdive",
"version": "3.3.0.406"
},
{
"_id": null,
"model": "aix",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "4.3.3"
},
{
"_id": null,
"model": "aix",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "4.3.2"
},
{
"_id": null,
"model": "aix",
"scope": "eq",
"trust": 0.3,
"vendor": "ibm",
"version": "4.3.1"
},
{
"_id": null,
"model": "secure os software for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "1.0"
},
{
"_id": null,
"model": "procurve switch 8000m",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "procurve switch 4108gl-bundle",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "procurve switch 4108gl",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "procurve switch 4000m",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "procurve switch",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "2525"
},
{
"_id": null,
"model": "procurve switch",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "2524"
},
{
"_id": null,
"model": "procurve switch",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "2512"
},
{
"_id": null,
"model": "procurve switch 2424m",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "procurve switch 2400m",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "procurve switch 1600m",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "ov/sam",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "3.0.1"
},
{
"_id": null,
"model": "openview network node manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.10"
},
{
"_id": null,
"model": "openview network node manager solaris",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.2"
},
{
"_id": null,
"model": "openview network node manager nt 4.x/windows",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.22000"
},
{
"_id": null,
"model": "openview network node manager hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.211.x"
},
{
"_id": null,
"model": "openview network node manager hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.210.x"
},
{
"_id": null,
"model": "openview network node manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.2"
},
{
"_id": null,
"model": "openview network node manager solaris",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.1"
},
{
"_id": null,
"model": "openview network node manager hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.111.x"
},
{
"_id": null,
"model": "openview network node manager hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.110.x"
},
{
"_id": null,
"model": "openview network node manager solaris",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0"
},
{
"_id": null,
"model": "openview network node manager nt 4.x/windows",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.02000"
},
{
"_id": null,
"model": "openview network node manager hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.011.x"
},
{
"_id": null,
"model": "openview network node manager hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.010.20"
},
{
"_id": null,
"model": "openview network node manager windows nt",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.0.23.51/4.0"
},
{
"_id": null,
"model": "openview network node manager solaris",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.01"
},
{
"_id": null,
"model": "openview network node manager hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.01"
},
{
"_id": null,
"model": "openview network node manager",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.01"
},
{
"_id": null,
"model": "openview network node manager solaris",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "4.11"
},
{
"_id": null,
"model": "openview network node manager hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "4.11"
},
{
"_id": null,
"model": "openview extensible snmp agent",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "4.0"
},
{
"_id": null,
"model": "openview emanate snmp agent solaris",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "14.22.x"
},
{
"_id": null,
"model": "openview emanate snmp agent hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "14.211.x"
},
{
"_id": null,
"model": "openview emanate snmp agent hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "14.210.20"
},
{
"_id": null,
"model": "openview distributed management",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0"
},
{
"_id": null,
"model": "openview distributed management",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "5.03"
},
{
"_id": null,
"model": "mc/serviceguard",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "jetdirect",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "x.20.00"
},
{
"_id": null,
"model": "jetdirect",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "x.08.32"
},
{
"_id": null,
"model": "jetdirect",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "x.08.00"
},
{
"_id": null,
"model": "ito/vpo/ovo unix",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "6.0"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "11.04"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.24"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "11.20"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "11.11"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "11.0"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.20"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.10"
},
{
"_id": null,
"model": "hp-ux",
"scope": "eq",
"trust": 0.3,
"vendor": "hp",
"version": "10.0"
},
{
"_id": null,
"model": "ems a.03.20",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "ems a.03.10",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "ems a.03.00",
"scope": null,
"trust": 0.3,
"vendor": "hp",
"version": null
},
{
"_id": null,
"model": "services nmserver",
"scope": "eq",
"trust": 0.3,
"vendor": "comtek",
"version": "3.4"
},
{
"_id": null,
"model": "associates unicenter",
"scope": null,
"trust": 0.3,
"vendor": "computer",
"version": null
},
{
"_id": null,
"model": "unixware",
"scope": "eq",
"trust": 0.3,
"vendor": "caldera",
"version": "7.1.1"
},
{
"_id": null,
"model": "unixware",
"scope": "eq",
"trust": 0.3,
"vendor": "caldera",
"version": "7.1.0"
},
{
"_id": null,
"model": "unixware",
"scope": "eq",
"trust": 0.3,
"vendor": "caldera",
"version": "7"
},
{
"_id": null,
"model": "openunix",
"scope": "eq",
"trust": 0.3,
"vendor": "caldera",
"version": "8.0"
},
{
"_id": null,
"model": "openserver",
"scope": "eq",
"trust": 0.3,
"vendor": "caldera",
"version": "5.0.6"
},
{
"_id": null,
"model": "openserver",
"scope": "eq",
"trust": 0.3,
"vendor": "caldera",
"version": "5.0.5"
},
{
"_id": null,
"model": "cacheos",
"scope": "eq",
"trust": 0.3,
"vendor": "cacheflow",
"version": "4.0"
},
{
"_id": null,
"model": "cacheos",
"scope": "eq",
"trust": 0.3,
"vendor": "cacheflow",
"version": "3.1"
},
{
"_id": null,
"model": "web nms msp edition",
"scope": null,
"trust": 0.3,
"vendor": "adventnet",
"version": null
},
{
"_id": null,
"model": "web nms",
"scope": null,
"trust": 0.3,
"vendor": "adventnet",
"version": null
},
{
"_id": null,
"model": "snmp utilities",
"scope": null,
"trust": 0.3,
"vendor": "adventnet",
"version": null
},
{
"_id": null,
"model": "snmp api",
"scope": null,
"trust": 0.3,
"vendor": "adventnet",
"version": null
},
{
"_id": null,
"model": "mediation server",
"scope": null,
"trust": 0.3,
"vendor": "adventnet",
"version": null
},
{
"_id": null,
"model": "management builder",
"scope": null,
"trust": 0.3,
"vendor": "adventnet",
"version": null
},
{
"_id": null,
"model": "fault management toolkit",
"scope": null,
"trust": 0.3,
"vendor": "adventnet",
"version": null
},
{
"_id": null,
"model": "configuration management toolkit",
"scope": null,
"trust": 0.3,
"vendor": "adventnet",
"version": null
},
{
"_id": null,
"model": "cli api",
"scope": null,
"trust": 0.3,
"vendor": "adventnet",
"version": null
},
{
"_id": null,
"model": "agent toolkit java/jmx edition",
"scope": null,
"trust": 0.3,
"vendor": "adventnet",
"version": null
},
{
"_id": null,
"model": "agent toolkit c edition",
"scope": "eq",
"trust": 0.3,
"vendor": "adventnet",
"version": null
},
{
"_id": null,
"model": "webcache",
"scope": "eq",
"trust": 0.3,
"vendor": "3com",
"version": "3000"
},
{
"_id": null,
"model": "webcache",
"scope": "eq",
"trust": 0.3,
"vendor": "3com",
"version": "1000"
},
{
"_id": null,
"model": "switch",
"scope": "eq",
"trust": 0.3,
"vendor": "3com",
"version": "4900"
},
{
"_id": null,
"model": "switch",
"scope": "eq",
"trust": 0.3,
"vendor": "3com",
"version": "4400"
},
{
"_id": null,
"model": "switch",
"scope": "eq",
"trust": 0.3,
"vendor": "3com",
"version": "3300"
},
{
"_id": null,
"model": "switch",
"scope": "eq",
"trust": 0.3,
"vendor": "3com",
"version": "1100"
},
{
"_id": null,
"model": "ps hub",
"scope": "eq",
"trust": 0.3,
"vendor": "3com",
"version": "50"
},
{
"_id": null,
"model": "ps hub",
"scope": "eq",
"trust": 0.3,
"vendor": "3com",
"version": "40"
},
{
"_id": null,
"model": "dual speed hub",
"scope": null,
"trust": 0.3,
"vendor": "3com",
"version": null
},
{
"_id": null,
"model": "brocade .0d",
"scope": "ne",
"trust": 0.3,
"vendor": "sgi",
"version": "2.6"
},
{
"_id": null,
"model": "solutions router ip console",
"scope": "ne",
"trust": 0.3,
"vendor": "innerdive",
"version": "3.3.0.407"
},
{
"_id": null,
"model": "jetdirect",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "x.21.00"
},
{
"_id": null,
"model": "jetdirect",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "x.08.32"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#107186"
},
{
"db": "CERT/CC",
"id": "VU#854306"
},
{
"db": "BID",
"id": "89608"
},
{
"db": "BID",
"id": "89661"
},
{
"db": "BID",
"id": "5043"
},
{
"db": "BID",
"id": "4732"
},
{
"db": "BID",
"id": "4203"
},
{
"db": "BID",
"id": "4088"
},
{
"db": "CNNVD",
"id": "CNNVD-200202-007"
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000033"
},
{
"db": "NVD",
"id": "CVE-2002-0012"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:ibm:aix",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:sun:solaris",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:hp:hp-ux",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:hp:vvos",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:microsoft:windows_2000",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:microsoft:windows-9x",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:microsoft:windows_nt",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:microsoft:windows_xp",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:redhat:linux",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2002-000033"
}
]
},
"credits": {
"_id": null,
"data": "Discovered by the Oulu University Secure Programming Group.",
"sources": [
{
"db": "BID",
"id": "5043"
},
{
"db": "BID",
"id": "4203"
},
{
"db": "BID",
"id": "4088"
}
],
"trust": 0.9
},
"cve": "CVE-2002-0012",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2002-0012",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2002-0012",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#107186",
"trust": 0.8,
"value": "69.26"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#854306",
"trust": 0.8,
"value": "42.64"
},
{
"author": "NVD",
"id": "CVE-2002-0012",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-200202-007",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#107186"
},
{
"db": "CERT/CC",
"id": "VU#854306"
},
{
"db": "CNNVD",
"id": "CNNVD-200202-007"
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000033"
},
{
"db": "NVD",
"id": "CVE-2002-0012"
}
]
},
"description": {
"_id": null,
"data": "Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. Multiple vendor SNMPv1 Trap handling implementations contain vulnerabilities that may allow unauthorized privileged access, denial-of-service conditions, or unstable behavior . If your site uses SNMP in any capacity, the CERT/CC encourages you to read the information provided below. ------------ This vulnerability information is a summary of multiple vulnerabilities released at the same time. Please note that the contents of vulnerability information other than the title are included. ------------ SNMP Protocol is status and performance information MIB (Management Information Base) Protocol used to exchange Management side SNMP Managers such as managed routers, switches and printers SNMP Communicates with management network devices called agents. Because of its wide acceptance in the market, SNMP Has become the standard for SNMP protocol version1 Is SNMPv1 Is the most widely implemented. this SNMPv1 Sent from the agent to the manager in the implementation of SNMP Trap message and sent from the manager to the agent SNMP Decrypt the request message / There are problems in interpreting. If this problem is used by an attacker, the following actions may be executed. Many other programs that you implement may also be affected because of a protocol problem. On the target host SNMP If the service is running, an attacker could execute arbitrary code \u30fb If a buffer overflow attack is feasible and a very long trap message SNMP If the host on which the service is running receives, the application may go into a denial of service state The effects described above vary from application to application. For details, refer to each product.Please refer to the \u201cOverview\u201d for the impact of this vulnerability. Windows 95 is prone to a denial-of-service vulnerability. MPE/iX is an Internet-ready operating system for the HP e3000 class servers. It is possible to crash the service by transmitting to it a maliciously constructed SNMPv1 request PDU. It was previously known as UCD-SNMP. They typically notify the manager that some event has occured or otherwise provide information about the status of the agent. \nMultiple vulnerabilities have been discovered in a number of SNMP implementations. The vulnerabilities are known to exist in the process of decoding and interpreting SNMP trap messages. \nAmong the possible consequences are denial of service and allowing attackers to compromise target systems. These depend on the individual vulnerabilities in each affected product. \nHP has confirmed that large traps will cause OpenView Network Node Manager to crash. This may be due to an exploitable buffer overflow condition",
"sources": [
{
"db": "NVD",
"id": "CVE-2002-0012"
},
{
"db": "CERT/CC",
"id": "VU#107186"
},
{
"db": "CERT/CC",
"id": "VU#854306"
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000033"
},
{
"db": "BID",
"id": "89608"
},
{
"db": "BID",
"id": "89661"
},
{
"db": "BID",
"id": "5043"
},
{
"db": "BID",
"id": "4732"
},
{
"db": "BID",
"id": "4203"
},
{
"db": "BID",
"id": "4088"
}
],
"trust": 4.68
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2002-0012",
"trust": 3.9
},
{
"db": "CERT/CC",
"id": "VU#107186",
"trust": 3.2
},
{
"db": "BID",
"id": "4088",
"trust": 2.2
},
{
"db": "BID",
"id": "4732",
"trust": 1.9
},
{
"db": "BID",
"id": "4089",
"trust": 1.9
},
{
"db": "BID",
"id": "4132",
"trust": 1.6
},
{
"db": "CERT/CC",
"id": "VU#854306",
"trust": 1.4
},
{
"db": "BID",
"id": "5043",
"trust": 1.3
},
{
"db": "XF",
"id": "8177",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000033",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200202-007",
"trust": 0.6
},
{
"db": "BID",
"id": "89608",
"trust": 0.3
},
{
"db": "BID",
"id": "89661",
"trust": 0.3
},
{
"db": "BID",
"id": "4203",
"trust": 0.3
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#107186"
},
{
"db": "CERT/CC",
"id": "VU#854306"
},
{
"db": "BID",
"id": "89608"
},
{
"db": "BID",
"id": "89661"
},
{
"db": "BID",
"id": "5043"
},
{
"db": "BID",
"id": "4732"
},
{
"db": "BID",
"id": "4203"
},
{
"db": "BID",
"id": "4088"
},
{
"db": "CNNVD",
"id": "CNNVD-200202-007"
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000033"
},
{
"db": "NVD",
"id": "CVE-2002-0012"
}
]
},
"id": "VAR-200202-0006",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.489583335
},
"last_update_date": "2026-04-10T23:59:45.929000Z",
"patch": {
"_id": null,
"data": [
{
"title": "HPSBUX00184",
"trust": 0.8,
"url": "http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00964944"
},
{
"title": "MS02-006",
"trust": 0.8,
"url": "http://www.microsoft.com/technet/security/bulletin/ms02-006.mspx"
},
{
"title": "RHSA-2001:163",
"trust": 0.8,
"url": "http://rhn.redhat.com/errata/RHSA-2001-163.html"
},
{
"title": "#00215",
"trust": 0.8,
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-22-00215-1"
},
{
"title": "#00215",
"trust": 0.8,
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-22-00215-3"
},
{
"title": "IBM Information for VU#107186",
"trust": 0.8,
"url": "http://www.kb.cert.org/vuls/id/IAFY-55KRCV"
},
{
"title": "MS02-006",
"trust": 0.8,
"url": "http://www.microsoft.com/japan/technet/security/Bulletin/ms02-006.mspx"
},
{
"title": "RHSA-2001:163",
"trust": 0.8,
"url": "http://www.jp.redhat.com/support/errata/RHSA/RHSA-2001-163J.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2002-000033"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-264",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2002-000033"
},
{
"db": "NVD",
"id": "CVE-2002-0012"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 3.0,
"url": "http://www.cert.org/advisories/ca-2002-03.html"
},
{
"trust": 2.4,
"url": "http://www.kb.cert.org/vuls/id/107186"
},
{
"trust": 1.6,
"url": "http://www.ee.oulu.fi/research/ouspg/protos/"
},
{
"trust": 1.6,
"url": "http://www.cert.org/tech_tips/denial_of_service.html"
},
{
"trust": 1.6,
"url": "http://www.ietf.org/rfc/rfc3000.txt"
},
{
"trust": 1.6,
"url": "http://www.ietf.org/rfc/rfc1212.txt"
},
{
"trust": 1.6,
"url": "http://www.ietf.org/rfc/rfc1213.txt"
},
{
"trust": 1.6,
"url": "http://www.ietf.org/rfc/rfc1215.txt"
},
{
"trust": 1.6,
"url": "http://www.ietf.org/rfc/rfc1270.txt"
},
{
"trust": 1.6,
"url": "http://www.ietf.org/rfc/rfc2570.txt"
},
{
"trust": 1.6,
"url": "http://www.ietf.org/rfc/rfc2571.txt"
},
{
"trust": 1.6,
"url": "http://www.ietf.org/rfc/rfc2572.txt"
},
{
"trust": 1.6,
"url": "http://www.ietf.org/rfc/rfc2573.txt"
},
{
"trust": 1.6,
"url": "http://www.ietf.org/rfc/rfc2574.txt"
},
{
"trust": 1.6,
"url": "http://www.ietf.org/rfc/rfc2575.txt"
},
{
"trust": 1.6,
"url": "http://www.ietf.org/rfc/rfc2576.txt"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/4088"
},
{
"trust": 1.6,
"url": "http://online.securityfocus.com/bid/4132"
},
{
"trust": 1.6,
"url": "http://online.securityfocus.com/bid/4732"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/4089"
},
{
"trust": 1.6,
"url": "http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/snmpv1/index.html"
},
{
"trust": 1.4,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2002-0012"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/advisories/4211"
},
{
"trust": 1.0,
"url": "http://www.redhat.com/support/errata/rhsa-2001-163.html"
},
{
"trust": 1.0,
"url": "ftp://patches.sgi.com/support/free/security/advisories/20020201-01-a"
},
{
"trust": 1.0,
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-006"
},
{
"trust": 1.0,
"url": "http://www.iss.net/security_center/alerts/advise110.php"
},
{
"trust": 1.0,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a1048"
},
{
"trust": 1.0,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a161"
},
{
"trust": 1.0,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a298"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/5043"
},
{
"trust": 1.0,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a144"
},
{
"trust": 0.8,
"url": "http://www.ciac.org/ciac/bulletins/m-042.shtml"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/security/ciadr/20020213snmp.html"
},
{
"trust": 0.8,
"url": "http://www.jpcert.or.jp/wr/2002/wr020701.txt"
},
{
"trust": 0.8,
"url": "http://www.jpcert.or.jp/wr/2002/wr020901.txt"
},
{
"trust": 0.8,
"url": "http://www.jpcert.or.jp/at/2002/at020001.txt"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnca-2002-03"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2002-0012"
},
{
"trust": 0.8,
"url": "http://xforce.iss.net/xforce/xfdb/8177"
},
{
"trust": 0.6,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2002-0013"
},
{
"trust": 0.6,
"url": "http://www.microsoft.com/technet/security/bulletin/ms02-006.asp"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/854306"
},
{
"trust": 0.3,
"url": "http://online.securityfocus.com/bid/4088"
},
{
"trust": 0.3,
"url": "http://online.securityfocus.com/bid/4089"
},
{
"trust": 0.3,
"url": "http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2f44605"
},
{
"trust": 0.3,
"url": "http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2f42769"
},
{
"trust": 0.3,
"url": "http://online.securityfocus.com/news/474"
},
{
"trust": 0.3,
"url": "http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms02-006.asp"
},
{
"trust": 0.3,
"url": "http://otn.oracle.com/deploy/security/pdf/snmp_2002_alert.pdf"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#107186"
},
{
"db": "CERT/CC",
"id": "VU#854306"
},
{
"db": "BID",
"id": "89608"
},
{
"db": "BID",
"id": "89661"
},
{
"db": "BID",
"id": "5043"
},
{
"db": "BID",
"id": "4732"
},
{
"db": "BID",
"id": "4203"
},
{
"db": "BID",
"id": "4088"
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000033"
},
{
"db": "NVD",
"id": "CVE-2002-0012"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "CERT/CC",
"id": "VU#107186",
"ident": null
},
{
"db": "CERT/CC",
"id": "VU#854306",
"ident": null
},
{
"db": "BID",
"id": "89608",
"ident": null
},
{
"db": "BID",
"id": "89661",
"ident": null
},
{
"db": "BID",
"id": "5043",
"ident": null
},
{
"db": "BID",
"id": "4732",
"ident": null
},
{
"db": "BID",
"id": "4203",
"ident": null
},
{
"db": "BID",
"id": "4088",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-200202-007",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2002-000033",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2002-0012",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2002-01-16T00:00:00",
"db": "CERT/CC",
"id": "VU#107186",
"ident": null
},
{
"date": "2002-02-12T00:00:00",
"db": "CERT/CC",
"id": "VU#854306",
"ident": null
},
{
"date": "2002-03-08T00:00:00",
"db": "BID",
"id": "89608",
"ident": null
},
{
"date": "2002-03-08T00:00:00",
"db": "BID",
"id": "89661",
"ident": null
},
{
"date": "2002-06-18T00:00:00",
"db": "BID",
"id": "5043",
"ident": null
},
{
"date": "2002-05-13T00:00:00",
"db": "BID",
"id": "4732",
"ident": null
},
{
"date": "2002-02-27T00:00:00",
"db": "BID",
"id": "4203",
"ident": null
},
{
"date": "2002-02-12T00:00:00",
"db": "BID",
"id": "4088",
"ident": null
},
{
"date": "2002-02-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200202-007",
"ident": null
},
{
"date": "2007-04-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2002-000033",
"ident": null
},
{
"date": "2002-02-13T05:00:00",
"db": "NVD",
"id": "CVE-2002-0012",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2007-11-07T00:00:00",
"db": "CERT/CC",
"id": "VU#107186",
"ident": null
},
{
"date": "2007-11-07T00:00:00",
"db": "CERT/CC",
"id": "VU#854306",
"ident": null
},
{
"date": "2002-03-08T00:00:00",
"db": "BID",
"id": "89608",
"ident": null
},
{
"date": "2002-03-08T00:00:00",
"db": "BID",
"id": "89661",
"ident": null
},
{
"date": "2009-07-11T13:56:00",
"db": "BID",
"id": "5043",
"ident": null
},
{
"date": "2002-05-13T00:00:00",
"db": "BID",
"id": "4732",
"ident": null
},
{
"date": "2009-07-11T10:56:00",
"db": "BID",
"id": "4203",
"ident": null
},
{
"date": "2009-07-11T10:56:00",
"db": "BID",
"id": "4088",
"ident": null
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200202-007",
"ident": null
},
{
"date": "2007-04-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2002-000033",
"ident": null
},
{
"date": "2025-04-03T01:03:51.193000",
"db": "NVD",
"id": "CVE-2002-0012",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "network",
"sources": [
{
"db": "BID",
"id": "89608"
},
{
"db": "BID",
"id": "89661"
},
{
"db": "BID",
"id": "5043"
},
{
"db": "BID",
"id": "4732"
},
{
"db": "BID",
"id": "4203"
},
{
"db": "BID",
"id": "4088"
}
],
"trust": 1.8
},
"title": {
"_id": null,
"data": "Multiple vulnerabilities in SNMPv1 trap handling",
"sources": [
{
"db": "CERT/CC",
"id": "VU#107186"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "Input Validation Error",
"sources": [
{
"db": "BID",
"id": "89608"
},
{
"db": "BID",
"id": "89661"
}
],
"trust": 0.6
}
}