Skip to content

Lantronix SLC8000/EMG serial-console appliance cluster: deterministic session tokens, snprintf truncation as a redirect primitive, and undocumented CLI commands as attack surface

Date reviewed: 2026-09-22 Source: GitHub advisory wave published 2026-09-22T18:33Z (13 GHSAs, CVSS up to 10.0). Products: SLC8000 secure serial console (OT/IT convergence appliance), EMG8500/EMG7500, SLB882, SLCx-03, SLCx-02. Same product family lineage as the June 23 UniFi OS and Lantronix appliance boundary page (EDS5000 failed-login command injection).

A single vendor wave that reads like an embedded-firmware pentest cheat sheet: five distinct, reusable primitives, several chained into unauthenticated RCE. Serial console servers terminate console access to switches, routers, PDUs, and OT gear — owning one is a post-exploitation goldmine, which is why these appliances deserve first-class treatment during internal recon.

The primitive table

Advisory Primitive Boundary crossed
CVE-2026-80155 / GHSA-h7c7-c453-99x2 (10.0) Session-cookie file path built with snprintf into a fixed-size buffer: a cookie value of a chosen length truncates the path at the required delimiter, then path traversal redirects the "validate this session" file read to an arbitrary on-disk file — e.g. the local user database — bypassing all session checks length-truncation + traversal on an authorization file selector → unauthenticated config read + arbitrary upload → RCE
CVE-2026-80154 / GHSA-c7q9-4pfw-ph5m (9.6) Session tokens generated deterministically from device model + current time at one-second resolution → tiny enumerable active-token set; combined with file-extension handling in web-server path routing to bypass per-session source-IP/User-Agent binding entropy of "session random" = attacker's clock-sweep budget; token derivation inputs must be audited, not just length
CVE-2026-80156 / GHSA-hmch-26g2-q5qx (9.1) Upload filename validator strips backslashes but skips the forward-slash check once a backslash was detected → a filename containing both characters writes outside the upload directory anywhere writable sanitizer handled one spelling and its combination; the composite bypass is the finding
CVE-2026-80148 / CVE-2026-80149 (8.6) / CVE-2026-80150 (7.5) Custom shellinaboxd WebSSH/WebTelnet listener builds its connection target with snprintf; an overlong username truncates the appended device-IP suffix (or the rooturl-derived own-IP), so the device opens SSH/Telnet to an attacker-chosen host — unauthenticated SSRF into the internal network the same fixed-buffer truncation bug class, this time redirecting a connection target instead of a file path
CVE-2026-80143 / CVE-2026-80144 / CVE-2026-80146 / CVE-2026-80147 (9.9 ×4) Undocumented mfc eeprom read / mfc eeprom write CLI commands: unbounded input copied into a bounded stack buffer and passed to system() — stack overflow and direct command injection as root, reachable by any authenticated CLI/terminal user hidden commands are attack surface; "authenticated" is not "low-privilege-safe" when every user reaches a root shell wrapper
CVE-2026-80145 / CVE-2026-80151 (9.1) set cifs password and set nfs download pass unsanitized input to system() → root command execution for holders of the services permission only least-privilege roles still reach the shell wrapper; test every permission tier, not just admin

Why this is durable operator guidance

  1. Fixed-buffer truncation is a redirect primitive, not just a crash. Two independent legs (session-file path, SSH target host) show the same shape: snprintf("%s%s", user, fixed_suffix) — feed enough user bytes and the server's own suffix (the delimiter, the device IP) never lands. Sweep rule for any embedded web server or browser-bridge daemon: for every field the firmware concatenates with a trusted suffix, send an overlong value and ask what the final string actually is. The result classifies: truncated path → file-selector hijack; truncated host → outbound-target hijack; truncated query → injection.
  2. Audit token derivation inputs, not token length. Model-string + one-second clock is a valid-looking 20+ char token with a search space of seconds × known model. On any appliance with observable session tokens: capture two tokens seconds apart, test for time-window structure (brute a few seconds of clock skew), and check whether tokens from idle devices are reusable windows. Corollary sweep: enumerate what the device believes is secret — model, serial, uptime, boot counter — anything guessable that reaches a generator is entropy debt.
  3. Sanitizer combination tests belong in every filename/upload check. If a validator handles \ and / separately, always test the pair in one value (..\/.. and ../\.. orderings). This is the same "handled one spelling, missed the composite" family as the Grav tokenizer and Netty RtspMethods trim — the fix coverage table is the test plan.
  4. Enumerate undocumented CLI commands on appliances. The mfc command family shipped undocumented yet reachable to any user. Firmware-side recon during authorized engagements: pull the firmware image (or use the vendor's own upgrade endpoint), strings the CLI parser table, and diff documented vs. compiled-in command names. Every undocumented verb is untested surface; several here route straight into system().
  5. Why serial console servers specifically: SLC8000-class devices hold credentials and direct console access to downstream network/OT gear. Owning the console server converts one host into physical-layer authority over every attached device (break-sequence into rescue shells, boot-order changes, out-of-band recovery during engagements). Version-fingerprint SLC8000 < 9.7.0.5, EMG < 9.7.0.1, and all SLB882/SLCx-03/SLCx-02 firmware during internal recon and flag as priority post-access targets.

Validation workflow (authorized scope only)

Lab appliances, downstream-isolated

Run any command-injection or file-write proof on a bench unit with no production serial devices attached. None of these advisories ship public PoC bytes; validate from advisory-described primitives only.

  1. Version/exposure inventory (no exploit): model + firmware build from the login page; placement (management VLAN vs. routable); whether downstream serial ports are configured. Presence-only facts.
  2. Token-structure study (passive, lab): create sessions at known second boundaries on your own unit; compare token prefixes/suffixes to detect model/time structure before any guessing. Proof = "tokens from adjacent seconds share structure", redacted in report.
  3. Truncation-selector proof (lab): with an authorized fixture, send a cookie value sized to truncate the session path at the delimiter and record whether the validator reads a different file class (error-shape change, not file contents). Never read the real user database; synthetic canary files only.
  4. WebSSH target proof (lab + owned listener): overlong-username request against your own appliance pointed at an owned listener on your test VLAN; proof = inbound connection from the appliance to the listener, per the owned-callback SSRF rule. Never target internal services.
  5. CLI command-boundary proof: on your own bench unit, any authenticated user; probe only that undocumented verbs exist and that an inert marker argument reaches logging/argv context. Do not chain to system() execution — the advisory text already proves it; report the boundary, not a root shell.

Reporting checklist

  • Exact model and firmware build per advisory boundary (<9.7.0.2, <9.7.0.3, <9.7.0.5, SLB882/SLCx = all versions) — the fix floors differ per leg; one firmware bump closes the whole set.
  • Per finding: which truncation/derivation/sanitization primitive, what was redirected (file path, connection target, or neither), and the canary-only evidence.
  • Blast radius statement: downstream serial-attached devices as the real impact; keep downstream host names/serials out of evidence.
  • Claim unauthenticated RCE only where both legs are shown (bypass → write → execution path); the token-enum and SSRF legs are their own high findings without the chain.

Tracked from the same wave without publication

  • CVE-2026-80152 (GHSA-r3rx-9f4x-5rmw) — remaining Lantronix item, memory-safety class per parser precedent.
  • SIPGO unvalidated Content-Length stream-parser DoS (CVE-2026-58268), Dasel lexer panic + unbounded-recursion DoS pair (CVE-2026-62866/59168), psd-tools crafted-PSD memory allocation (CVE-2026-59991) — DoS/memory-safety class.
  • OpenCVE notification-test SSRF to internal/metadata (CVE-2026-62282, 6.5) — "test this webhook/channel" buttons as SSRF legs already covered by the AAP credential-Test exfil page; no new axis.
  • Adobe Campaign Classic vendor pack (~12 GHSAs: code injection, SSRF, SQLi, incorrect authorization; CVEs 75699–89276 family) and RTI Connext Professional pack (~10 memory-safety GHSAs) — vendor sync waves, sparse per-item detail, tracked per Oracle-CPU precedent.
  • glibc ld.so stack overflow (CVE-2026-95818) + ld.so TOCTOU (CVE-2026-86805), Linux RPC-over-RDMA heap OOB (CVE-2026-13087), rpcbind unauthenticated flaw (CVE-2026-94640), SSSD LDAP-access-provider flaw (CVE-2026-90462) — system/local class.
  • Apache Calcite Avatica unrestricted Class.forName plugin instantiation (CVE-2026-70410) — advisory itself notes no known dangerous static initializers; unsafe-reflection class, tracked.
  • webpy session fixation (no rotation after auth) + render_jinja XSS (CVE-2026-79312/79311), MikroTik RouterOS input validation (CVE-2026-93345, pre-beta fix) — sparse/router classes.

Related pages: UniFi OS and Lantronix appliance boundary checks (EDS5000 failed-login command leg), Sept 21 management-plane page (config-write-as-RCE siblings), Sept 22 Dancer2 guard-semantics page (verdict-vs-sink copy divergence twin of the backslash/forward-slash composite miss).