Advisory · CVE-2026-80144
Lantern: hidden eeprom command hands root to any authenticated Lantronix user
An unauthenticated-facing but credentialed command injection via the undocumented mfc eeprom write command lets any authenticated user run arbitrary shell commands as root on Lantronix SLC8000, EMG8500/7500 and sibling out-of-band management devices. CVSS 9.9.
- Vendor
- Lantronix
- Product
- SLC8000 / EMG8500 / EMG7500 out-of-band devices
- Identifier / CWE
- CVE-2026-80144
CWE-78 - Action timing
- Immediate
Explain it like I’m five
A remote control for a data center has a hidden button on the back. Anyone with a login can press it and get the master key to the whole building, including every machine the remote control is plugged into.
- 01Authenticated session
An attacker authenticates as any low-privileged user to the terminal or CLI interface of the Lantronix device.
- 02Hidden command
They invoke the undocumented mfc eeprom write command, which the firmware exposes without restricting it.
- 03Injection
Unsanitized user input is passed straight into a system() call on the device.
- 04Root shell
Arbitrary shell commands execute as root, giving complete control of the device and reach into downstream serial-attached equipment.
What happened
Independent research published September 21, 2026 (the Lantern disclosure) found an OS command injection in Lantronix autonomous out-of-band devices. The undocumented mfc eeprom write command passes unsanitized user input to a system() call, so any authenticated user on the terminal or CLI interface can execute arbitrary commands as root. Affected products: SLC8000 before firmware 9.7.0.2, EMG8500/EMG7500 before 9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02. NVD rates it CVSS 9.9 (v3.1). Because these appliances manage console access to racks of servers, compromise can pivot into downstream serial-attached devices.
The vendors firmware downloads for SLC8000 9.7.0.2 and EMG8500/7500 9.7.0.1 resolve the issue.
What to do
- Upgrade SLC8000 appliances to firmware 9.7.0.2 or later and EMG8500/7500 appliances to 9.7.0.1 or later, per the vendor firmware links in the disclosure.
- Restrict management interface access to a dedicated OOB network; these consoles should never be reachable from general user networks.
- Review device logs for unexpected CLI activity or eeprom command usage, since the command is undocumented and has no legitimate operator use.
- For SLB882, SLCx-03, and SLCx-02, where every firmware version is listed as affected, contact Lantronix for patched builds.
Management note
This is root compromise of the appliances that provide last-resort console access to production racks. Anyone with a device login could own the box and hop into attached servers. Patching is the fix; network segmentation of the OOB plane is the containment that should have been there already.