CVE-2026-80148 Lantronix SLC8000 - Server Side Request Forgery

Lantronix SLC8000 < 9.7.0.3, EMG8500/EMG7500 < 9.7.0.1, and all SLB882 firmware versions contain a server-side request forgery caused by improper input handling in WebSSH/WebTelnet listener, letting unauthenticated attackers redirect SSH connections to attacker-controlled hosts, exploit requires sending crafted overlong username strings.

CVSS base score 8.6 /10
High
CISA KEV
Not listed
Public exploit
None known
Authentication
Not required
EPSS
0.58% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Server Side Request Forgery
Impact
Server Side Request Forgery
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Published
22 September 2026
Updated
15 October 2026
Weakness
CWE-918

Vendor fix

Update to firmware v9.7.0.3 for SLC8000, v9.7.0.1 for EMG8500/EMG7500, or latest available version for SLB882.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs