High priorityDisclosed

Advisory · CVE-2026-80146

Lantern: buffer overflow in Lantronix mfc eeprom read can yield code execution

A stack-based buffer overflow in the undocumented mfc eeprom read command on Lantronix out-of-band devices lets any authenticated user potentially execute arbitrary code by supplying oversized input. CVSS 9.9.

Advisory published September 22, 2026Independent summary
Vendor
Lantronix
Product
SLC8000 / EMG8500 / EMG7500 out-of-band devices
Identifier / CWE
CVE-2026-80146
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

A vending machine has a hidden slot that only reads short notes. Feed it a very long note and the machine gets confused enough to start following your instructions instead of its own.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated session

    An attacker logs in as any user to the device terminal or CLI.

  2. 02Hidden command

    They call the undocumented mfc eeprom read command with an oversized input.

  3. 03Overflow

    Unbounded input is copied into a bounded stack buffer before being passed to a system() call.

  4. 04Code execution

    The overflow can hijack execution, potentially yielding arbitrary code with root-level impact.

What happened

The Lantern research (published September 21, 2026) also disclosed a stack-based buffer overflow in the undocumented mfc eeprom read command on Lantronix autonomous out-of-band devices. Unbounded user input is copied into a bounded stack buffer before reaching a system() call, so an authenticated attacker supplying oversized input can potentially execute arbitrary code. Affected: SLC8000 before 9.7.0.2, EMG8500/EMG7500 before 9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02. CVSS 9.9 (v3.1).

What to do

  1. Upgrade SLC8000 to firmware 9.7.0.2 or later and EMG8500/7500 to 9.7.0.1 or later.
  2. Restrict management interfaces to an isolated OOB network.
  3. Ask Lantronix for patched builds for SLB882, SLCx-03, and SLCx-02, where all firmware versions are affected.

Management note

A memory-safety bug in a hidden command is the most dangerous kind of flaw in infrastructure hardware: hard to audit, easy to trigger with a login. Treat the whole Lantronix fleet as one patching job.