Advisory · CVE-2026-80151
Lantronix CLI command injection via set nfs download
An OS command injection in the set nfs download command on Lantronix out-of-band devices lets authenticated users with the services permission execute arbitrary commands as root. CVSS 9.1.
- Vendor
- Lantronix
- Product
- SLC8000 / EMG8500 / EMG7500 out-of-band devices
- Identifier / CWE
- CVE-2026-80151
CWE-78 - Action timing
- Immediate
Explain it like I’m five
A file-download menu asks where to fetch a file from. Whatever address you type is handed to the courier as spoken directions, so typing directions to anywhere you like sends the courier, and your extra instructions, straight there.
- 01Services permission
An attacker authenticates with the services permission to the CLI or terminal interface.
- 02Command invoked
They run set nfs download with a crafted parameter.
- 03Injection
The unsanitized parameter is passed to a system() call.
- 04Root execution
The payload executes as root on the device.
What happened
From the September 21, 2026 Lantern disclosure: the set nfs download command on Lantronix autonomous out-of-band devices passes unsanitized user input to a system() call, allowing an authenticated attacker with the services permission to run arbitrary shell commands as root. Affected: SLC8000 before firmware 9.7.0.3, EMG8500/EMG7500 before 9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02. CVSS 9.1 (v3.1).
What to do
- Upgrade SLC8000 to firmware 9.7.0.3 or later and EMG8500/7500 to 9.7.0.1 or later.
- Limit services-permission accounts and keep the management plane on an isolated OOB network.
- Check logs for odd set nfs download invocations.
Management note
Another instance of the same systemic flaw: CLI parameters reaching the shell unfiltered. Patch the full device family and treat the OOB network as a privileged zone that deserves its own access controls.