CVE-2026-80144

Executive Summary

CVE-2026-80144 is a critical OS command injection vulnerability (CWE-78) in Lantronix serial console managers and terminal servers, carrying a CVSS 3.1 base score of 9.9. An authenticated attacker — holding credentials for any user account on the device — can invoke an undocumented mfc eeprom write command through the terminal or CLI interface and pass unsanitized input that is executed as root via a system() call. Affected products include SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02; the latter three have no fix at any firmware version. Full compromise of confidentiality, integrity, and availability is achievable, with lateral impact to downstream serial-attached infrastructure.

Technical Analysis

The vulnerability resides in the command-processing path of the affected Lantronix devices. Per the NVD description, an undocumented command verb — mfc eeprom write — is exposed through the terminal or CLI interface. The handler for this command takes user-supplied input and passes it, without sanitization, into a system() call, which the underlying host OS interprets through a shell. Because shell metacharacters are not escaped or filtered, an operator-supplied argument is interpreted as shell syntax rather than as a literal data value.

Two properties elevate this from a routine injection to a critical finding:

1. Root execution context. The injected command executes as root. There is no privilege boundary between the CLI-authenticated user and the OS superuser once the injection is triggered. This is consistent with the CVSS vector's C:H/I:H/A:H — full loss of confidentiality, integrity, and availability.
2. Minimal privilege requirement. The CVSS vector specifies PR:L (Low privileges), and the description states attackers "can authenticate as any user." There is no requirement for administrative CLI roles or elevated device privileges — any valid account is sufficient.

The scope field is marked S:C (Changed), reflecting that the compromise crosses a security boundary: the vulnerable component (the CLI command handler on the appliance) yields control of the host OS, and further impacts serial-attached downstream devices reachable through the console server.

No CVE metadata provides the exact parameter name, argument position, or textual form of the injection point. The description confirms only that the parameter of the mfc eeprom write command is unsanitized and reaches system(). Any more granular claim about argument parsing, shell expansion behavior, or input length limits would be speculation and is deliberately omitted here.

Because the command is undocumented, it does not appear in vendor CLI reference material, which reduces the likelihood of incidental discovery by legitimate operators and increases its value as a targeted backdoor primitive. Its presence in the command set is nonetheless reachable by any authenticated CLI user who knows or guesses the verb.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code exists for this CVE at the time of writing. The attack chain below is inferred at the vulnerability-class level from the NVD description; specific payload strings are illustrative of OS command injection mechanics generally and are not drawn from any published exploit.

1. Reconnaissance and target identification. An attacker enumerates internet- or WAN-exposed Lantronix console servers and terminal servers using Shodan or similar services, searching for device banners, login pages, and TLS certificates referencing Lantronix product lines. Devices reachable over SSH, Telnet, or the web CLI (where enabled) are prioritized. Because the vulnerability requires authentication, reconnaissance also focuses on credential sourcing: default credentials, credentials reused from other infrastructure, or credentials obtained via prior phishing or credential-dumping operations.

2. Authentication. The attacker authenticates to the terminal or CLI interface. Per the NVD description, any user account suffices — the attacker does not need an administrative role. This substantially widens the set of credentials that enable exploitation: read-only operators, service accounts, and any stale account still enabled on the device are all valid entry points.

3. Triggering the flaw. The attacker issues the undocumented CLI command mfc eeprom write with a crafted argument. Because the argument is passed unsanitized into a system() call, shell metacharacters embedded in the argument cause the host shell to execute an additional, attacker-controlled command. The attacker does not need to supply a valid EEPROM write value; the injection fires during command processing. Exact metacharacter handling (whether the shell is /bin/sh, whether quoting is applied upstream, whether the injection must escape a surrounding format string) is not documented in available sources and must be determined by the attacker empirically.

   No public PoC is available; the precise payload syntax, argument position, and any required terminators are unknown from the provided data. Attackers would fuzz the parameter or reason from firmware analysis if a firmware image is obtainable.

4. Post-exploitation. The injected command runs as root. From that position the attacker can read or exfiltrate device configuration (including stored credentials, serial-port mappings, and any secrets used to reach downstream devices), persist via firmware or configuration modification, disable logging and authentication, or pivot through the console server into serial-attached devices such as routers, firewalls, switches, OT/ICS controllers, and out-of-band management ports that are otherwise unreachable from the network. Because the appliance sits in the management plane, this access frequently bypasses network segmentation between IT and operational technology environments.

Impact Assessment

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9 Critical) indicates a remotely reachable, low-complexity attack requiring only low privileges and no user interaction, with changed scope and full loss of confidentiality, integrity, and availability.

Business impact:

• Management-plane compromise. Lantronix console servers are out-of-band access points for network infrastructure, servers, and OT equipment. Root on the appliance grants control over every serial-attached device's console — typically equivalent to physical access.
• Credential and secret exposure. Device configuration routinely holds credentials for managed downstream assets, enabling further lateral movement.
• Integrity and availability loss. Firmware, configuration, and EEPROM parameters (the very surface targeted by the vulnerable command) can be altered or destroyed, potentially rendering the appliance unbootable or silently misconfigured.
• Persistence. Because the vulnerable command operates on EEPROM and the attacker holds root, tampering can survive reboots, complicating incident response.
• Unpatchable population. SLB882, SLCx-03, and SLCx-02 remain vulnerable at all firmware versions, meaning no upgrade path mitigates the flaw for those models. Only SLC8000 (v9.7.0.2) and EMG8500/EMG7500 (v9.7.0.1) have documented fixed versions.
• Blast radius. Scope is Changed; a single compromised console server can expose an entire downstream serial estate, including devices that have no other network exposure.

Given no CISA KEV listing, no EPSS score, and no public exploit, the observed exploitation likelihood is presently unquantified — but the vulnerability is trivial to weaponize once the command form is known, and the target class (out-of-band management) is a known objective for advanced threat actors.

Detection Guidance

Detection must combine CLI/command auditing on the device itself with network and host telemetry, because the vulnerable interface is an authenticated command line rather than an HTTP request path.

Sigma Rule

title: Lantronix Undocumented mfc eeprom write Command Abuse (CVE-2026-80144)
id: 8f2c1a4e-6b7d-4e21-9a3c-0d5e7f1b2c34
status: experimental
description: Detects execution of the undocumented 'mfc eeprom write' command via CLI or terminal, which is the trigger for OS command injection in Lantronix SLC8000/EMG8500/EMG7500/SLB882/SLCx-03/SLCx-02.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-80144
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/mfc'
    CommandLine|contains: 'mfc eeprom write'
  selection_meta:
    CommandLine|contains:
      - ';'
      - '&&'
      - '||'
      - '`'
      - '$('
      - '|'
  condition: selection_proc and selection_meta
falsepositives:
  - Legitimate administrative use of mfc eeprom write (rare; command is undocumented)
level: critical
tags:
  - attack.t1059
  - attack.privilege_escalation
  - cve.2026.80144

YARA Rule

rule CVE_2026_80144_Lantronix_MFC_EEPROM_CMD_INJECTION
{
    meta:
        description = "Detects command-injection trigger strings for Lantronix mfc eeprom write (CVE-2026-80144)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-80144"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $cmd = "mfc eeprom write" ascii nocase
        $m1  = /mfc\s+eeprom\s+write[^\n]{0,64}[;&|`]/
        $m2  = /mfc\s+eeprom\s+write[^\n]{0,64}\$\(/
    condition:
        $cmd and any of ($m*)
}

Note: this rule is intended for scanning captured CLI session logs, firmware blobs, or configuration artifacts where the command appears; it will not match raw network traffic.

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-80144 Lantronix Undocumented 'mfc eeprom write' Command Injection Attempt"; flow:established,to_server; content:"mfc eeprom write"; nocase; fast_pattern; pcre:"/mfc\s+eeprom\s+write[^\r\n]{0,64}(;|\||`|\$\(|&&|\|\|)/i"; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; reference:cve,2026-80144; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-80144; sid:202680144; rev:1;)

Detection caveat: the trigger is issued over an interactive terminal/CLI session (SSH, Telnet, or serial). The rule only assists where that session traffic is unencrypted (e.g., Telnet) or where a decrypted/terminating inspection point exists. SSH-encrypted sessions will not match and must be covered by host-side CLI auditing.

Elastic Detection

sequence by host.id, user.name with maxspan=5m
  [process where event.type == "start" and process.name in ("sh","bash") and
     process.command_line : "mfc eeprom write"]
  [process where event.type == "start" and process.parent.name in ("sh","bash","mfc") and
     process.args : ("*/*" or "nc" or "wget" or "curl" or "id" or "cat" or "chmod")]

The second stage is heuristic: any child process spawned from the shell invoked by the mfc command handler is indicative of injection. Analysts should tune the child-process indicator list to match the command set permitted on their appliances.

Splunk SPL Query

index=* (sourcetype=linux_audit OR sourcetype=syslog OR sourcetype=cli_session)
| eval cli=coalesce(command_line, cmd, message)
| where match(cli, "mfc\\s+eeprom\\s+write")
      AND match(cli, "[;&|`]|\\$\\(|\\|\\|")
| rex field=cli "(?<injected>[;&|`]|\\$\\().*"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(cli) as cli
        by host, user, src_ip
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="lantronix,cve-2026-80144,">
  <rule id="2026801" level="12">
    <decoded_as>syslog</decoded_as>
    <match>mfc eeprom write</match>
    <regex type="pcre2">[;&|`]|\$\(|\|\|</regex>
    <description>Possible CVE-2026-80144 exploitation: Lantronix 'mfc eeprom write' command injection attempt detected</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>command_injection,privilege_escalation,</group>
  </rule>

  <rule id="2026802" level="14">
    <if_sid>2026801</if_sid>
    <options>no_full_log</options>
    <description>CVE-2026-80144: successful command injection indicator (injected payload following mfc eeprom write)</description>
    <group>command_injection,persistence,</group>
  </rule>
</group>

Deployment note: rule 2026801 depends on the appliance's CLI activity reaching a Wazuh-collected log source. Where the device does not emit command-level audit logs, enable remote syslog/command accounting, or rely on the network rules above for unencrypted sessions.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The fixed firmware versions named in the NVD description (SLC8000 v9.7.0.2, EMG8500/EMG7500 v9.7.0.1) are the product of vendor documentation within the CVE record; no vendor advisory, OSV package entry, or secondary patch source has been independently verified in the data provided. Treat patching as version-matching against the NVD description, not as confirmed-remediated.

1) Immediate mitigations

• Remove all internet/WAN exposure of Lantronix management interfaces. Place console servers behind a hardened jump host or VPN; never port-forward SSH, Telnet, or web CLI directly.
• Disable Telnet entirely and prefer SSH with key-based authentication. If the trigger can be issued over serial, restrict physical and terminal-server access.
• Rotate and audit credentials on all affected devices. Because any authenticated user can exploit this, disable stale, shared, and non-essential accounts; enforce least privilege and strong unique credentials for remaining operators.
• Restrict the CLI: where the device platform permits command allow-listing or role-based command restrictions, block or remove access to the mfc eeprom write verb for all non-essential roles.
• Segment out-of-band management networks from production, OT, and the general user VLAN so that downstream serial-attached devices are not reachable from a compromised appliance.
• Enable and ship device command/audit logs to the SIEM and apply the detection rules above.

2) Patch / upgrade steps

• SLC8000: upgrade to firmware v9.7.0.2 or later.
• EMG8500 / EMG7500: upgrade to firmware v9.7.0.1 or later.
• SLB882 / SLCx-03 / SLCx-02: no fixed firmware version is documented — all firmware versions of these models are affected. There is currently no upgrade path; constrain these devices with network isolation and access controls, and engage Lantronix directly for a remediation statement or roadmap.
• Verify the applied firmware version on each device after upgrade and re-test; do not assume that a version string alone confirms remediation absent a vendor advisory confirming the fix.

3) Long-term hardening

• Maintain a full inventory of Lantronix console servers, terminal servers, and serial-attached devices, including end-of-life models with no patch path.
• Establish a firmware patch cadence and subscribe to vendor security bulletins; out-of-band management appliances are frequently neglected in vulnerability management programs.
• Adopt zero-trust access for management planes: MFA-gated bastion access, session recording for all CLI activity, and just-in-time privilege grants.
• Harden default configurations at deployment: change default credentials, disable unused services and command verbs, and enforce least-privilege operator roles.
• Add the mfc eeprom write command string and shell-metacharacter patterns to continuous detection and to configuration-drift monitoring.

References

• NVD — CVE-2026-80144: https://nvd.nist.gov/vuln/detail/CVE-2026-80144
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• Lantronix product security / support portal (vendor advisories and firmware downloads for SLC8000, EMG8500, EMG7500, SLB882, SLCx-02, SLCx-03): https://www.lantronix.com/support/
• MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-80144 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor and in-the-wild status: No public proof-of-concept, exploit code, Nuclei template, CISA KEV entry, or threat-actor campaign association was present in the provided intelligence. Exploitation in the wild has not been confirmed by any tracked source at the time of writing.