Server-side Request Forgery Vulnerability in Lantronix Products

CVE-2026-80148

What is CVE-2026-80148?

The affected Lantronix products exhibit a server-side request forgery vulnerability within the WebSSH/WebTelnet listener. This flaw enables unauthenticated attackers to manipulate the SSH connection process and redirect connections to malicious endpoints. By exploiting an overlong username input via the shellinaboxd component, an attacker can truncate the device's IP suffix, allowing them to establish unauthorized communication with otherwise unreachable internal network services. This vulnerability poses significant risks to network security, as attackers could potentially enumerate sensitive endpoints or gain access to internal resources.

References