CVE-2026-80155

Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web configuration server constructs the session cookie file path using snprintf with a fixed-size buffer; by supplying a cookie value of a specific length an attacker causes the path to truncate at the required delimiter and leverages path traversal to redirect authentication validation to an arbitrary on-disk file such as the local user database, bypassing all session checks. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.

• CWE-22

• https://revrb.net/2026/09/21/revrb-lantern.html
• https://ts.lantronix.com/ftp/SLC9000/9.7.0.2R1/
• https://ts.lantronix.com/ftp/emg/EMG_7500/9.7.0.1R2/
• https://ts.lantronix.com/ftp/emg/EMG_8500/9.7.0.1R2/
• https://ts.lantronix.com/ftp/slc8000/9.7.0.5R2/
• https://www.vulncheck.com/advisories/lantronix-autonomous-out-of-band-devices-unauthenticated-authentication-bypass-via-snprintf-path-truncation

Published

Sep 22, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8015Inappropriate implementation in Media in Google Chrome prior…5.4
• CVE-2026-80150Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before f…7.5
• CVE-2026-80151Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before f…9.1
• CVE-2026-80152Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before f…9.1
• CVE-2026-80153Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-80154All firmware versions of Lantronix SLC8000, SLC9000, EMG8500…9.6
• CVE-2026-80156Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before f…9.1
• CVE-2026-80158A flaw was found in the ipa_getkeytab module of the communit…5.5
• CVE-2026-80159Acrobat Reader is affected by an Untrusted Search Path vulne…4
• CVE-2026-8016Use after free in WebRTC in Google Chrome prior to 148.0.777…8.8
• CVE-2026-80160Acrobat Reader is affected by an out-of-bounds read vulnerab…5.5
• CVE-2026-80161Acrobat Reader is affected by an Access of Resource Using In…7.8