CVE-2026-80146
Received Received - Intake

Stack-Based Buffer Overflow in Lantronix SLC8000 Firmware

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: VulnCheck

Description
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and supply an oversized input to trigger the overflow, potentially achieving complete loss of confidentiality, integrity, and availability on the affected device and impacting downstream serial-attached devices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-80146
EUVD
EUVD-2026-84511

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
lantronix slc8000 to 9.7.0.2 (exc)
lantronix emg8500 to 9.7.0.1 (exc)
lantronix slb882 *
lantronix slcx-03 *
lantronix slcx-02 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow in Lantronix devices including SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02. It occurs when authenticated attackers exploit an undocumented command to read EEPROM data. The vulnerability allows oversized user input to overflow a stack buffer before being passed to a system() call, enabling arbitrary code execution.

Detection Guidance

Check device firmware versions against affected releases (SLC8000 < 9.7.0.2, EMG8500/EMG7500 < 9.7.0.1, or any version of SLB882/SLCx-03/SLCx-02). Use CLI commands like 'show version' or 'system info' to verify firmware. Monitor for unauthorized CLI access or unusual 'mfc eeprom read' command usage.

Impact Analysis

An attacker could gain full control over the affected device, leading to complete loss of confidentiality, integrity, and availability. This could allow unauthorized access, data theft, or disruption of services. Downstream serial-attached devices may also be impacted.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected devices may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Update affected Lantronix devices to patched firmware versions (SLC8000 to v9.7.0.2+, EMG8500/EMG7500 to v9.7.0.1+). Disable unnecessary CLI access and restrict user privileges. Implement network segmentation to isolate vulnerable devices and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart