High priorityDisclosed

Advisory · CVE-2026-80149

Lantronix WebSSH rooturl flaw lets unauthenticated attackers steer SSH sessions

A server-side request forgery in the WebSSH/WebTelnet listener of Lantronix out-of-band devices lets an unauthenticated attacker redirect SSH terminal connections to arbitrary hosts and probe internal networks. CVSS 8.6.

Advisory published September 22, 2026Independent summary
Vendor
Lantronix
Product
SLC8000 / EMG8500 / EMG7500 out-of-band devices
Identifier / CWE
CVE-2026-80149
CWE-918
Action timing
Immediate
ELI5

Explain it like I’m five

A hotel phone booth dials whatever number is written on the note you hand it. You hand it the number of the internal security office, and the booth connects you there, no questions asked.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Web listener reached

    An unauthenticated attacker reaches the WebSSH/WebTelnet listener on the device.

  2. 02Parameter tampered

    They modify the rooturl parameter, which the custom shellinaboxd trusts to identify its own address.

  3. 03Session redirected

    The device opens its SSH terminal connection to an attacker-chosen host or IP.

  4. 04Internal probing

    The attacker uses the device as a pivot to enumerate or talk to internal endpoints that are otherwise unreachable.

What happened

The Lantern disclosure (September 21, 2026) reports an SSRF vulnerability in the WebSSH/WebTelnet listener of Lantronix autonomous out-of-band devices. The custom shellinaboxd derives its own address from the rooturl parameter of the web connection; an unauthenticated attacker who modifies that parameter can redirect the SSH terminal connection to an arbitrary host, enumerating or communicating with internal network endpoints. Affected: SLC8000 before firmware 9.7.0.2, EMG8500/EMG7500 before 9.7.0.1, and all firmware versions of SLB882. CVSS 8.6 (v3.1).

What to do

  1. Upgrade SLC8000 to firmware 9.7.0.2 or later and EMG8500/7500 to 9.7.0.1 or later.
  2. Do not expose the web management or WebSSH listener to the internet or untrusted networks.
  3. Review web server logs for unusual rooturl values or SSH sessions to unexpected destinations.

Management note

Unauthenticated network pivot through the device that is supposed to be your safety net. If the OOB listener is internet-facing, assume it has been used as a relay and check what internal endpoints were touched.