CVE-2026-80144

Katalog CVE

CVSS 9.9 · Critical EPSS 1,5%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). Skor CVSS 3.1 9.9 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.

Rincian

Terbit di NVD

22 September 2026

Terakhir diubah

24 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

9.9 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://revrb.net/2026/09/21/revrb-lantern.html
• https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/
• https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
• https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/
• https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/
• https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-cli-command-injection-via-mfc-ee...