CVE-2026-80155: Lantronix SLC8000 SLC9000 EMG authentication bypass in web management portal

CVE-2026-80155 · Severity: critical · CVSS 10 · Published 2026-09-22

Lantronix out-of-band management devices used in data centers, telecom networks, and government infrastructure contain an authentication bypass vulnerability in their web management portal. An unauthenticated attacker can exploit a buffer overflow in session cookie handling to read sensitive configuration files, upload arbitrary files, and achieve remote code execution, potentially compromising the entire device and any downstream serial-connected systems.

Technologies: Lantronix EMG7500, Lantronix EMG8500, Lantronix SLB882, Lantronix SLC8000, Lantronix SLC9000, Lantronix SLCx-02, Lantronix SLCx-03. Vendors: Lantronix.

Quick answers

Is CVE-2026-80155 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-80155 being exploited in the wild.
How severe is CVE-2026-80155?
Critical severity, with a CVSS score of 10, published 22 September 2026.
Which products and versions are affected?
Lantronix EMG7500 before 9.7.0.1; Lantronix EMG8500 before 9.7.0.1; Lantronix SLB882 all firmware versions; Lantronix SLC8000 before 9.7.0.5; and 3 more.
Is there a fix for CVE-2026-80155?
A patch was published on 2026-09-18: SLC9000 firmware 9.7.0.2 released; SLC8000 firmware 9.7.0.5 and EMG series 9.7.0.1 made available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80155 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-80155?
Check whether you run Lantronix EMG7500, Lantronix EMG8500, Lantronix SLB882 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The web management portal uses snprintf with a fixed-size buffer to construct the session cookie file path; supplying a cookie value of specific length causes the path to truncate at a delimiter and enables path traversal to redirect authentication validation to an arbitrary file such as the local user database. This requires no authentication, user interaction, or network positioning beyond reaching the management portal. A successful exploit grants complete code execution on the device and potential access to serial-managed devices downstream.

Affected products

  • Lantronix SLC8000 before 9.7.0.5
  • Lantronix SLC9000 before 9.7.0.2
  • Lantronix EMG8500 before 9.7.0.1
  • Lantronix EMG7500 before 9.7.0.1
  • Lantronix SLB882 all firmware versions
  • Lantronix SLCx-03 all firmware versions
  • Lantronix SLCx-02 all firmware versions

Timeline

  • 2026-09-21: disclosed: REVRB-LANTERN research published
  • 2026-09-22: advisory: CVE-2026-80155 published on NVD
  • 2026-09-18: patched: SLC9000 firmware 9.7.0.2 released; SLC8000 firmware 9.7.0.5 and EMG series 9.7.0.1 made available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.