CVE-2026-80152 LANTRONIX CVE debrief

Who should care

System administrators and security teams responsible for Lantronix devices should assess exposure and prioritize remediation. This vulnerability can impact device confidentiality, integrity, and availability, as well as downstream serial-attached devices.

Why it matters

CVE-2026-80152 is a critical command injection vulnerability in Lantronix devices that requires immediate attention from system administrators and security teams. The vulnerability allows authenticated attackers to execute arbitrary shell commands as root, potentially impacting device and downstream device security.

• Potential loss of device confidentiality, integrity, and availability
• Possible impact on downstream serial-attached devices
• Need for verification of affected versions and scope
• Priority for firmware updates and access restriction

Technical summary

The Lantronix SLC8000, SLC9000, EMG8500, and EMG7500 devices have a command injection vulnerability that allows authenticated attackers with services permission to execute arbitrary shell commands as root. This can be exploited through the set script schedule command, which passes unsanitized user input to a system() call. The vulnerability can be triggered by authenticated attackers with services permission, potentially impacting device and downstream serial-attached devices. Firmware updates are available to mitigate this vulnerability.

Defensive priority

High

Recommended defensive actions

• Review and apply firmware updates for Lantronix SLC8000, SLC9000, EMG8500, and EMG7500 devices
• Restrict access to the terminal or CLI interface
• Monitor device logs for suspicious activity
• Verify device configurations and user permissions
• Perform vulnerability scanning to identify exposed systems
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the vendor and affected product information is not comprehensive. Further verification is needed to determine the full scope of affected devices and versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.