CVE-2026-80155

Lantronix SLC8000, EMG8500/EMG7500, and SLB882/SLCx-03/SLCx-02 serial console managers contain an unauthenticated authentication bypass in the web management portal's upload endpoint, rated the maximum CVSS 4.0 score of 10.0. The flaw stems from the web configuration server building the session-cookie file path with snprintf into a fixed-size buffer; an attacker who supplies a cookie value of a specific length truncates the path at its delimiter and then uses path traversal (CWE-22) to point session validation at an arbitrary file such as the local user database, satisfying all session checks. With the bypass, an unauthenticated remote attacker can read sensitive configuration files (including credentials) and upload files to arbitrary filesystem locations, achieving remote code execution and complete loss of confidentiality, integrity, and availability on the device, with potential compromise of downstream serial-connected equipment. No public proof of concept is known and the CVE is not in the CISA KEV catalog, but internet-reachable management interfaces are at critical risk given the trivial pre-auth nature of the attack.

What to do: Upgrade SLC8000 to firmware v9.7.0.5 or later and EMG8500/EMG7500 to v9.7.0.1 or later immediately; for SLB882/SLCx-03/SLCx-02 no fixed firmware exists, so remove their management interfaces from the internet entirely and isolate them behind a VPN or strict firewall allow-list. Until patched, restrict access to the web management portal, rotate any credentials stored on these devices (they are readable via this flaw), and review logs and uploaded files for signs of pre-auth file read or write activity. Because these devices gate serial access to downstream infrastructure, audit connected equipment for compromise as well.