Path Traversal Vulnerability in Lantronix SLC8000 Series and EMG8500/EMG7500 Products

CVE-2026-80156

What is CVE-2026-80156?

A path traversal vulnerability exists in the web management portal's upload endpoint of various Lantronix devices, such as the SLC8000 and EMG8500/EMG7500. Authenticated attackers can exploit this flaw to upload arbitrary files to any writable location within the device's filesystem. The issue arises from insufficient validation of the upload filename, allowing attackers to bypass security controls. By leveraging backslashes and forward slashes in the filename, attackers can write outside the designated upload directory, leading to potential unauthorized access to sensitive data and control over the affected device, as well as risks to connected devices.

References