Vulnerability · Published Sep 22, 2026 · Assigned by VulnCheck

CVE-2026-80148Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation

High 8.6

In plain English

A high-severity server-side request forgery in EMG7500 from LANTRONIX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.6%top 52.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.

Affected products (as reported)

Vendor	Product	Versions
LANTRONIX	SLC8000	0 – before 9.7.0.3
LANTRONIX	EMG8500	0 – before 9.7.0.1
LANTRONIX	EMG7500	0 – before 9.7.0.1
LANTRONIX	SLB882	*
LANTRONIX	SLC9000	0 – before 9.7.0.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

Researcher Disclosure technical-description
SLC8000 Firmware patch
EMG8500 Firmware patch
EMG7500 Firmware patch
SLC9000 Firmware patch
https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-username-truncation third-party-advisory