CVE-2026-80148

Description

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.

Overview

State: PUBLISHED
Assigner (CNA): VulnCheck
CVSS severity: HIGH
CVSS score: 7.7 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Effective score: 7.7 / 10 HIGH source: CNA overview
CWE(s): CWE-918
Reserved: 2026-08-25
Published: 2026-09-22 15:20 UTC
Last updated: 2026-09-22 17:44 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/80xxx/CVE-2026-80148.json
Linked Threat: CVE-2026-80148 — Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-22 16:18:01 UTC
NVD last modified: 2026-09-22 20:25:55 UTC
NVD CVSS v3.1: 8.6 / 10 HIGH source: disclosure@vulncheck.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Exploitability subscore: 3.9 / 10
Impact subscore: 4.0 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-84514
Assigner: VulnCheck
Published: Sep 22, 2026, 3:20:33 PM
Updated: Sep 22, 2026, 5:44:20 PM
EUVD base score (CVSS 4.0): 7.7 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
EUVD-reported EPSS: 0.0000
Vendors: Lantronix
Products: EMG8500 (0 <9.7.0.1)

SLC8000 (0 <9.7.0.2)

EMG7500 (0 <9.7.0.1)

SLB882 (*)
Aliases: GHSA-6rw9-fmc4-f3gq

ENISA description: Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.

EUVD references (5)

Affected products (4)

Vendor	Product	Versions	Platforms
LANTRONIX	SLC8000	`0` (affected)	—
LANTRONIX	EMG8500	`0` (affected)	—
LANTRONIX	EMG7500	`0` (affected)	—
LANTRONIX	SLB882	`*` (affected)	—

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

Researcher Disclosure technical-description
SLC8000 Firmware patch
EMG8500 Firmware patch
EMG7500 Firmware patch
https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-username-truncation third-party-advisory

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (5)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://revrb.net/2026/09/21/revrb-lantern.html disclosure@vulncheck.com
https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/ disclosure@vulncheck.com
https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/ disclosure@vulncheck.com
https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/ disclosure@vulncheck.com
https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-username-truncation disclosure@vulncheck.com

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Chrome Releases: Stable Channel Update for Desktop

web:chromereleases.googleblog.com

The Chrome team is delighted to announce the promotion of Chrome 148 to the stable channel for Windows, Mac and Linux. This will roll out ov...

2026-09-23 15:14 UTC
August 2026 cumulative update - .NET Framework | Microsoft Learn

web:learn.microsoft.com

This update installs the complete .NET Framework 3.5 product for Windows 11, version 26H1 (build version 28000) and newer. Unlike traditional cumulative updates that patch individual components, this update delivers the full .NET Framework 3.5 product as a standalone installer. It replaces any previously installed version.

2026-09-23 15:14 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-23 15:14 UTC
Description of the security update for Office 2016: August 11, 2026 ...

web:support.microsoft.com

Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home. (See What version of Office am I using?) How to get and install the update Method 1: Microsoft Update This update is available from Microsoft Update. When you turn on ...

2026-09-23 15:14 UTC
March 13, 2026—Hotpatch KB5084597 (OS Builds 26200.7982 and 26100.7982 ...

web:support.microsoft.com

This update for Windows 11, version 25H2 and 24H2 (KB5084597) incudes security improvements. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates. To view the ...

2026-09-23 15:14 UTC
SAP Security Patch Day - April 2026

web:support.sap.com

SAP security patch day bulletin This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the support portal and applies patches on priority to protect their SAP landscape. On 14 th of April 2026 , SAP security patch day saw the release of 19 new security notes. There is 1 update to previously ...

2026-09-23 15:14 UTC
SAP Security Patch Day - May 2026

web:support.sap.com

SAP security Patch Day Bulletin This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the support portal and applies patches on priority to protect their SAP landscape. On 12 th of May 2026 , SAP security patch day saw the release of 15 new security notes.

2026-09-23 15:14 UTC
August 2026 CVE Advisory Notification - Security

web:support.servicenow.com

Due to additional analysis provided by the security researcher who discovered CVE - 2026 -6876, we have upgraded the severity rating of CVE - 2026 -6876 from High to Critical. This change affects only the severity

2026-09-23 15:14 UTC
Vulnerability Digest August 2026 - Third-Party Updates - Action1

web:www.action1.com

Vulnerability Digest August 2026 Updates - Third-Party Updates This digest explains the most serious vulnerabilities in popular software that have been patched over the past month. For even more information, watch the recorded August 2026 Vulnerability Digest webinar, join our next Patch Tuesday webinar and visit our Patch Tuesday Watch page.

2026-09-23 15:14 UTC
Security Vulnerabilities fixed in Firefox 148 — Mozilla

web:www.mozilla.org

Bug 2008426 # CVE - 2026 -2791: Mitigation bypass in the Networking: Cache component Reporter Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic Impact low References Bug 2015220 # CVE - 2026 -2807: Memory safety bugs fixed in Firefox 148 and Thunderbird 148 ...

2026-09-23 15:14 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-80148.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80148",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T17:22:22.576164Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T17:44:20.907Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SLC8000",
          "vendor": "LANTRONIX",
          "versions": [
            {
              "lessThan": "9.7.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EMG8500",
          "vendor": "LANTRONIX",
          "versions": [
            {
              "lessThan": "9.7.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "EMG7500",
          "vendor": "LANTRONIX",
          "versions": [
            {
              "lessThan": "9.7.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SLB882",
          "vendor": "LANTRONIX",
          "versions": [
            {
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "RE/VRb"
        }
      ],
      "datePublic": "2026-09-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using a snprintf call with user-supplied input; by supplying an overlong username string an attacker causes the device IP suffix to be truncated, redirecting the resulting connection to an arbitrary host. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T15:20:33.864Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Researcher Disclosure",
          "tags": [
            "technical-description"
          ],
          "url": "https://revrb.net/2026/09/21/revrb-lantern.html"
        },
        {
          "name": "SLC8000 Firmware",
          "tags": [
            "patch"
          ],
          "url": "https://ts.lantronix.com/ftp/slc8000/9.7.0.3R3/"
        },
        {
          "name": "EMG8500 Firmware",
          "tags": [
            "patch"
          ],
          "url": "https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/"
        },
        {
          "name": "EMG7500 Firmware",
          "tags": [
            "patch"
          ],
          "url": "https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-webssh-ssrf-via-username-truncation"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-80148",
    "datePublished": "2026-09-22T15:20:33.864Z",
    "dateReserved": "2026-08-25T20:43:54.261Z",
    "dateUpdated": "2026-09-22T17:44:20.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}