SLCx-02 (< 9.7.0.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/slcx-02--9.7.0.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 22 Sep 2026 16:37:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCommand Injection in Lantronix Console Managers (CVE-2026-80143)https://feed.craftedsignal.io/briefs/2026-09-lantronix-command-injection/Tue, 22 Sep 2026 16:37:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-lantronix-command-injection/Authenticated attackers can execute arbitrary shell commands as root on multiple Lantronix console manager models by exploiting an undocumented MFC EEPROM read command that triggers command injection via a system call.Lantronix console managers including the SLC8000 (versions before 9.7.0.2), EMG8500 and EMG7500 (versions before 9.7.0.1), and all versions of the SLB882, SLCx-03, and SLCx-02 contain a critical command injection vulnerability (CVE-2026-80143). This vulnerability stems from an undocumented MFC EEPROM read command that fails to sanitize user-supplied input before passing it to a system call. An authenticated attacker, regardless of their privilege level, can leverage this flaw to execute arbitrary commands with root privileges. Given the nature of these devices as console managers, successful exploitation provides total control over the appliance and potentially facilitates unauthorized access to downstream serial-attached infrastructure.

Impact

Successful exploitation results in full loss of confidentiality, integrity, and availability of the targeted console manager. Because these devices manage serial connections to other networking hardware, an attacker could pivot or conduct lateral movement into the serial-attached environment. The vulnerability impacts enterprise infrastructure management, posing a severe risk to data center availability and administrative control over managed assets.

Recommendation

Prioritize the immediate patching of vulnerable Lantronix console managers.

  • Upgrade SLC8000 devices to firmware v9.7.0.2 or later.
  • Upgrade EMG8500 and EMG7500 devices to firmware v9.7.0.1 or later.
  • For legacy or unsupported models (SLB882, SLCx-03, SLCx-02) where patches may not be available, restrict management interface access to highly controlled jump hosts and disable the terminal or CLI interface for non-administrative users.
]]>criticaladvisorycve-2026-80143command-injectionnetwork-infrastructure