Executive brief
Lantronix out-of-band management devices (SLC8000, SLC9000, EMG8500, EMG7500, and SLB882) used to provide remote serial access to network infrastructure contain a vulnerability allowing unauthenticated attackers to redirect connections to arbitrary hosts. An attacker can exploit this to access internal network systems that would normally be isolated, potentially gaining unauthorized access to serial-managed devices, credentials, and critical infrastructure controls across data centers, telecom networks, and government systems.
Technical details
The WebSSH/WebTelnet listener in the shellinaboxd component fails to validate the rooturl parameter, allowing attackers to inject arbitrary host addresses that redirect outbound Telnet connections. The vulnerability requires no authentication and is exploitable over the network. An attacker can enumerate or connect to internal endpoints, potentially exposing serial console access to critical devices; patches are available for SLC8000 and EMG series but SLB882 devices remain unpatched.
Affected products
- Lantronix SLC8000 before v9.7.0.3
- Lantronix SLC9000 before v9.7.0.2
- Lantronix EMG8500 before v9.7.0.1
- Lantronix EMG7500 before v9.7.0.1
- Lantronix SLB882 all versions
Timeline
- 2026-09-22: disclosed
- 2026-09-18: patched: SLC9000 v9.7.0.2 released