Advisory · CVE-2026-80152
Lantronix CLI command injection via set script schedule
An OS command injection in the set script schedule command on Lantronix out-of-band devices lets authenticated users with the services permission execute arbitrary commands as root. CVSS 9.1.
- Vendor
- Lantronix
- Product
- SLC8000 / EMG8500 / EMG7500 out-of-band devices
- Identifier / CWE
- CVE-2026-80152
CWE-78 - Action timing
- Immediate
Explain it like I’m five
An alarm clock lets you write a note for when it rings, but it reads the note out loud as orders to the staff. Writing orders instead of a note means the staff follow them.
- 01Services permission
An attacker authenticates with the services permission to the CLI or terminal interface.
- 02Command invoked
They run set script schedule with a crafted parameter.
- 03Injection
The unsanitized parameter reaches a system() call.
- 04Root execution
The payload runs as root on the device.
What happened
From the September 21, 2026 Lantern disclosure: the set script schedule command on Lantronix autonomous out-of-band devices passes unsanitized user input to a system() call, letting an authenticated attacker with the services permission execute arbitrary shell commands as root. Affected: SLC8000 before firmware 9.7.0.3, EMG8500/EMG7500 before 9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02. CVSS 9.1 (v3.1).
What to do
- Upgrade SLC8000 to firmware 9.7.0.3 or later and EMG8500/7500 to 9.7.0.1 or later.
- Reduce services-permission accounts to the minimum and isolate the management interfaces.
- Review device audit logs for unexpected script schedule changes.
Management note
Scheduled-task configuration doubling as a root shell is a reminder that these appliances are full Linux systems wearing a CLI costume. Patch the family and segment the OOB plane.