Advisory · CVE-2026-80145
Lantronix CLI command injection via set cifs password reaches root
A command injection in the set cifs password command on Lantronix out-of-band devices lets authenticated users with the services permission run arbitrary commands as root. CVSS 9.1.
- Vendor
- Lantronix
- Product
- SLC8000 / EMG8500 / EMG7500 out-of-band devices
- Identifier / CWE
- CVE-2026-80145
CWE-78 - Action timing
- Immediate
Explain it like I’m five
A settings page asks you to set a password, but whatever you type gets read aloud as instructions to the doorman. An attacker types instructions instead of a password and the doorman obeys.
- 01Services permission
An attacker holds a device account with the services permission and reaches the CLI or terminal interface.
- 02Command invoked
They run set cifs password with a crafted parameter value.
- 03Injection
The parameter flows unsanitized into a system() call.
- 04Root execution
Their payload runs as root on the device.
What happened
As part of the September 21, 2026 Lantern disclosure, researchers reported an OS command injection in the set cifs password command on Lantronix autonomous out-of-band devices. The command passes unsanitized user input to a system() call, so an authenticated attacker with the services permission can execute arbitrary shell commands as root. Affected: SLC8000 before firmware 9.7.0.2, EMG8500/EMG7500 before 9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02. CVSS 9.1 (v3.1).
What to do
- Upgrade SLC8000 to firmware 9.7.0.2 or later and EMG8500/7500 to 9.7.0.1 or later.
- Audit which accounts hold the services permission and trim it to the minimum set of administrators.
- Keep management interfaces off general networks and review logs for unusual set cifs password activity.
Management note
A privileged-but-routine command became a root shell because the firmware shell-quotes nothing. This is one of a cluster of identical injection flaws across the product line; patch everything in the family, not just this model.