CVE-2026-80155
Remote code execution
- Published22 Sept 2026
Description
Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HRemediation
No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.
References
- https://revrb.net/2026/09/21/revrb-lantern.html
- https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
- https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/
- https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/
- https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/
- https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-unauthenticated-authentication-bypass-via-snprintf-path-truncation
Related CVEs
Recent high-severity vulnerabilities sharing a weakness type.
Frequently asked
Is CVE-2026-80155 being actively exploited?
CVE-2026-80155 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.03%.
How severe is CVE-2026-80155?
CVE-2026-80155 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 1.03% probability of exploitation.
How do I fix CVE-2026-80155?
Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2026-80155 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.