CVE-2026-80146

Katalog CVE

CVSS 9.9 · Critical EPSS 0,85%

Kerentanan Stack-based Buffer Overflow. Skor CVSS 3.1 9.9 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.

Rincian

Terbit di NVD

22 September 2026

Terakhir diubah

26 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

9.9 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

0,85% peluang dieksploitasi; lebih tinggi dari 57,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://revrb.net/2026/09/21/revrb-lantern.html
• https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/
• https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
• https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/
• https://ts.lantronix.com/ftp/slc8000/9.7.0.2R1/
• https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-stack-based-buffer-overflow-via-...