CVE-2026-80143

Executive Summary

CVE-2026-80143 is an authenticated command injection vulnerability (CWE-78) in Lantronix serial console managers and device management gateways, rated CVSS 9.9. The flaw is reachable through an undocumented mfc eeprom read command that passes unsanitized user input into a system() call, allowing any authenticated user — not just administrators — to execute arbitrary shell commands as root. Affected products include SLC8000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882, SLCx-03, and SLCx-02, which have no confirmed fix.

Technical Analysis

The vulnerability resides in the terminal/CLI management interface of Lantronix console servers and EMG device gateways. According to the NVD description, an undocumented command, mfc eeprom read, accepts a user-supplied parameter that is passed to an underlying system() call without sanitization. Because the input is not validated or escaped, an attacker who can reach the CLI — whether via SSH, serial console, or a terminal session — can append shell metacharacters to the parameter and cause the operating system to execute arbitrary commands with root privileges.

Two properties make this particularly dangerous:

1. Low privilege requirement with no UI interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the attack is network-reachable, requires only low privileges, and needs no user interaction. The CNA explicitly states attackers "can authenticate as any user to the terminal or CLI interface," meaning a non-administrative account is sufficient to reach the vulnerable command surface.

2. Scope change. The S:C (Scope: Changed) metric reflects that successful exploitation can escape the vulnerable CLI component and affect other resources on the device and downstream serial-attached devices. The description notes "complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices."

Because the flaw is triggered through the device's own authenticated management interface, it does not rely on a web-facing endpoint or a memory-corruption primitive. It is a pure injection-into-interpreter issue: user input reaching a shell-capable execution path. The root cause is the absence of input validation or escaping before the system() invocation.

No public proof-of-concept, Nuclei template, or exploit code exists as of this report. The attack chain below is therefore described at the vulnerability-class level and inferred from the documented mechanism, not from a validated exploit.

Exploitation Scenarios

1) Reconnaissance / target identification. An attacker enumerates internet- or network-exposed Lantronix devices (console servers SLC8000, SLCx-02/SLCx-03, SLB882; gateways EMG8500/EMG7500) using banner grabbing, certificate inspection, or Shodan-style queries. Exposure typically occurs on management VLANs; however, misconfigured deployments place these devices on routable segments.

2) Access acquisition. Per the CNA, the adversary authenticates to the terminal or CLI interface as any user — no administrative role is required. Credentials may be obtained via default/weak passwords, credential reuse, prior foothold, or phishing.

3) Triggering the flaw. Once authenticated, the attacker invokes the undocumented mfc eeprom read command and supplies a crafted parameter value. Because that parameter is passed verbatim into a system() call, shell metacharacters embedded in the parameter are interpreted by the shell, resulting in arbitrary command execution. No specific parameter syntax is documented publicly; exploitation relies on the unsanitized-input-to-shell mechanism itself.

4) Post-exploitation impact. Commands run as root, granting complete control of the device: reading and modifying configuration, extracting stored credentials and keys, altering serial port forwarding, disabling logging/authentication controls, and pivoting to downstream serial-attached devices (the description explicitly notes potential impact to those devices). Given root access and the scope change, the device can be repurposed as a persistent foothold within an OT/ICS or network-management environment.

Note: No public PoC is available; the chain above is inferred from the CVE description and vulnerability class.

Impact Assessment

The CVSS 3.1 base score of 9.9 (Critical) is driven by:

• AV:N (Network) — reachable over the network.
• AC:L (Low) — no specialized conditions required.
• PR:L (Low) — only a basic authenticated account is needed.
• UI:N (None) — no victim interaction.
• S:C (Changed) — impact crosses a security boundary to other components and attached devices.
• C:H / I:H / A:H — total loss of confidentiality, integrity, and availability.

Business impact: affected devices are serial console servers and management gateways commonly used to administer network equipment, servers, and OT/ICS assets. Root compromise enables full manipulation of managed serial-attached devices, credential theft, configuration tampering, and use of the device as a pivot point. The scope-change rating and the "downstream" impact language elevate this from a single-device compromise to a potential management-plane breach.

Blast radius: internet- or management-network-exposed Lantronix SLC8000, SLCx-02, SLCx-03, SLB882, EMG8500, and EMG7500 units. SLB882, SLCx-03, and SLCx-02 have no confirmed patch, so their entire deployed base remains at risk. CISA KEV listing: NO at time of writing. EPSS: not yet scored by FIRST.org — no probability figure is asserted here.

Detection Guidance

Sigma Rule

title: Lantronix CLI Undocumented mfc eeprom read Command Injection Attempt
id: 8f2a1c74-3b6e-4d5a-9c01-7e4f8a2b1d90
status: experimental
description: Detects attempts to invoke the undocumented 'mfc eeprom read' command with shell metacharacters in the parameter, targeting Lantronix SLC/EMG devices (CVE-2026-80143).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-80143
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    CommandLine|contains:
      - 'mfc eeprom read'
  selection_meta:
    CommandLine|contains:
      - ';'
      - '|'
      - '&&'
      - '$('
      - '`'
      - '>'
  condition: selection_cmd and selection_meta
fields:
  - CommandLine
  - User
  - ParentCommandLine
falsepositives:
  - Authorized maintenance scripts using sed/pipes on the same command line
level: high
tags:
  - attack.t1190
  - cve.2026.80143

YARA Rule

rule CVE_2026_80143_Lantronix_MFC_EEPROM_Injection
{
    meta:
        description = "Detects presence of the undocumented 'mfc eeprom read' command string in firmware or captured CLI artifacts, associated with CVE-2026-80143"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-80143"
        cve = "CVE-2026-80143"

    strings:
        $cmd1 = "mfc eeprom read" ascii wide nocase
        $cmd2 = "mfc eeprom" ascii wide nocase
        $sys  = "system(" ascii

    condition:
        ($cmd1 or $cmd2) and $sys
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-80143 Lantronix mfc eeprom read command injection attempt"; flow:to_server,established; content:"mfc eeprom read"; nocase; pcre:"/(mfc\s+eeprom\s+read[^\n]{0,64}[;|&`$])/i"; classtype:attempted-admin; reference:cve,2026-80143; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-80143; sid:202680143; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.command_line : "mfc eeprom read" and
  (process.command_line : "*;*" or
   process.command_line : "*|*" or
   process.command_line : "*&&*" or
   process.command_line : "*$(*" or
   process.command_line : "*`*")

Splunk SPL Query

index=* (source=*cli* OR source=*console* OR source=*syslog* OR sourcetype=linux_secure)
| eval cmd=coalesce(CommandLine, command, _raw)
| where match(cmd, "(?i)mfc\\s+eeprom\\s+read")
| where match(cmd, "[;|&`]|\\$\\(|&&")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, cmd
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="lantronix,cve-2026-80143,">
  <rule id="100643" level="12">
    <decoded_as>syslog</decoded_as>
    <match>mfc eeprom read</match>
    <regex>[;&|`]|\$\(</regex>
    <description>CVE-2026-80143: Possible Lantronix mfc eeprom read command injection attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The following must be verified directly against vendor advisories before relying on it.

1) Immediate mitigations

• Restrict management-interface access: place SLC/EMG devices on a dedicated, segmented management VLAN; block CLI/terminal (SSH, telnet, console-over-IP) exposure from untrusted networks.
• Enforce least privilege: because the flaw requires only any authenticated user, audit and minimize the accounts permitted to reach the terminal/CLI. Disable default and shared accounts.
• Enable and forward authentication and CLI command logging to a central SIEM; monitor for mfc eeprom read and shell metacharacters in command arguments.
• Where technically feasible, apply egress filtering so a compromised device cannot reach downstream serial-attached assets or the broader network.

2) Patch / upgrade steps

• SLC8000: upgrade to firmware v9.7.0.2 or later.
• EMG8500 / EMG7500: upgrade to firmware v9.7.0.1 or later.
• SLB882, SLCx-03, SLCx-02: no fix identified — all firmware versions are affected. Isolate these models, monitor closely, and confirm status with Lantronix support; do not assume a patch exists.
• Verify fix versions against the official Lantronix advisory, as patch provenance in this report is unverified (0/4 confidence).

3) Long-term hardening

• Maintain a current inventory of all Lantronix console servers and gateways, including firmware baseline.
• Adopt a vulnerability management cadence that covers OT/serial-management gear and tracks vendor firmware releases.
• Replace end-of-support models (notably SLB882, SLCx-03, SLCx-02) that cannot be patched.
• Enforce strong, unique credentials and MFA where supported for management access.
• Apply network monitoring and anomaly detection to CLI sessions on these devices.

References

• NVD — CVE-2026-80143: https://nvd.nist.gov/vuln/detail/CVE-2026-80143
• CWE-78 (OS Command Injection): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Lantronix official security advisories page (verify fix versions for SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, SLCx-02): https://www.lantronix.com/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-80143 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild status: No public PoC, exploit code, or Nuclei template is available, and CVE-2026-80143 is not in the CISA KEV catalog. No named threat actor campaigns have been attributed to this CVE in the provided intelligence. EPSS has not yet scored this vulnerability.