CVE-2026-80150 LANTRONIX CVE debrief

Who should care

Defenders responsible for Lantronix SLC8000, SLC9000, EMG8500, and EMG7500 devices, especially those with WebSSH/WebTelnet listeners exposed to untrusted networks, should assess their exposure and prioritize remediation.

Why it matters

CVE-2026-80150 is a high-severity vulnerability in Lantronix devices that allows unauthenticated attackers to establish Telnet connections to arbitrary endpoints. Defenders should prioritize verifying exposure, applying firmware updates, and implementing compensating controls to prevent unauthorized access to internal network endpoints.

• Verify exposure of affected devices to untrusted networks.
• Assess potential for unauthorized access to internal network endpoints.
• Prioritize firmware updates for affected devices.
• Monitor for suspicious Telnet connections.

Technical summary

Lantronix SLC8000, SLC9000, EMG8500, and EMG7500 devices have a server-side request forgery vulnerability in the WebSSH/WebTelnet listener. This allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter, an attacker redirects the Telnet terminal connection to an arbitrary host or IP.

Defensive priority

Defenders should prioritize verifying exposure of Lantronix SLC8000, SLC9000, EMG8500, and EMG7500 devices, especially those with WebSSH/WebTelnet listeners exposed to untrusted networks.

Recommended defensive actions

• Verify exposure of Lantronix SLC8000, SLC9000, EMG8500, and EMG7500 devices, especially those with WebSSH/WebTelnet listeners exposed to untrusted networks.
• Check for and apply firmware updates to affected devices: v9.7.0.3 for SLC8000, v9.7.0.2 for SLC9000, and v9.7.0.1 for EMG8500/EMG7500.
• Implement compensating controls, such as restricting access to WebSSH/WebTelnet listeners and monitoring for suspicious Telnet connections.
• Review network configurations to ensure that affected devices are not exposing sensitive services to untrusted networks.
• Monitor for suspicious Telnet connections and review logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source references indicate a server-side request forgery vulnerability in Lantronix devices, allowing unauthenticated attackers to establish Telnet connections to arbitrary endpoints. However, details about exploitation, victims, or business impact are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.