Command Injection Vulnerability in Lantronix SLC8000 and EMG Series Devices
CVE-2026-80151

9.4CRITICAL

Key Information:

Vendor

Lantronix

Status
Slc8000
Emg8500
Emg7500
Slb882
Vendor
CVE Published:
22 September 2026

What is CVE-2026-80151?

The Lantronix SLC8000, EMG8500, and EMG7500 devices, along with the SLB882 and SLCx-03/SLCx-02 series, are affected by a command injection vulnerability. This issue allows authenticated users with services permission to execute arbitrary shell commands as root by exploiting the unsanitized input to the set nfs download command. As a result, attackers can compromise the confidentiality, integrity, and availability of the affected devices, posing a severe risk to downstream serial-attached devices and overall network security.

Affected Version(s)

EMG7500 0 < 9.7.0.1

EMG8500 0 < 9.7.0.1

SLB882 *

References

https://revrb.net/2026/09/21/revrb-lantern.html
technical-description
https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/
patch
https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/
patch

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

RE/VRb
.