CVE-2026-80148 LANTRONIX CVE debrief

Who should care

Defenders responsible for Lantronix devices, especially those with WebSSH/WebTelnet listeners exposed to the internet or internal networks, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-80148 is a server-side request forgery vulnerability in Lantronix devices that allows unauthenticated attackers to establish SSH connections to attacker-controlled endpoints. Defenders should prioritize verifying exposure, applying patches, and implementing compensating controls.

• Enumeration of internal network endpoints
• Communication with inaccessible endpoints
• Potential data breaches through internal network access
• Verification of device exposure and firmware versions

Technical summary

The custom shellinaboxd build uses a snprintf call with user-supplied input, allowing attackers to cause the device IP suffix to be truncated and redirect the resulting connection to an arbitrary host. This vulnerability affects Lantronix SLC8000, SLC9000, EMG8500, and EMG7500 devices, enabling unauthenticated attackers to establish SSH connections to attacker-controlled endpoints. The vulnerability arises from the custom shellinaboxd build's use of a snprintf call with user-supplied input, which can be exploited by providing an overlong username string.

Defensive priority

Defenders should prioritize verifying exposure of Lantronix devices, especially those with WebSSH/WebTelnet listeners exposed to the internet or internal networks. They should assess if devices are running vulnerable firmware versions and apply patches or mitigations as available.

Recommended defensive actions

• Verify Lantronix device exposure and firmware versions
• Apply patches or mitigations for vulnerable devices
• Monitor for suspicious SSH connections
• Implement compensating controls for internal network endpoint protection
• Review asset inventory for Lantronix devices
• Plan vendor-supported updates or mitigations through normal change control
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and affected products. However, the corpus does not establish versions, exploitation, impact, or remediation beyond provided official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.