CVE-2026-80149 LANTRONIX CVE debrief

Who should care

Lantronix device administrators and security teams should assess exposure and prioritize patching. They should verify patch deployment, monitor internal network activity for suspicious connections, and enumerate exposed devices to prioritize remediation. Security teams should also assess potential for lateral movement and track exceptions and retest remediated assets.

Why it matters

CVE-2026-80149 is a server-side request forgery vulnerability in Lantronix devices that allows attackers to connect to internal network endpoints. Lantronix device administrators and security teams should assess exposure and prioritize patching.

• Verify patch deployment for vulnerable devices
• Monitor internal network activity for suspicious connections
• Enumerate exposed devices and prioritize remediation
• Assess potential for lateral movement

Technical summary

Lantronix SLC8000, SLC9000, EMG8500/EMG7500, and SLB882 devices have a server-side request forgery vulnerability in WebSSH/WebTelnet listeners. Unaunthenticated attackers can cause the device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. This allows attackers to connect to internal network endpoints that would otherwise be inaccessible.

Defensive priority

Patch vulnerable devices, verify inventory, and monitor for suspicious connections

Recommended defensive actions

• Patch Lantronix SLC8000, SLC9000, EMG8500/EMG7500, and SLB882 devices with available firmware updates
• Verify device inventory and configurations
• Monitor for suspicious connections and internal network activity
• Verify patch deployment for vulnerable devices
• Enumerate exposed devices and prioritize remediation
• Assess potential for lateral movement
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Lantronix provides firmware updates for affected devices. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the SSH terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible. Defenders should verify patch deployment, monitor for suspicious and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.