CVE-2026-80145

Executive Summary

CVE-2026-80145 is a critical command injection vulnerability (CWE-78) affecting Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 console servers and terminal management appliances. The flaw allows an authenticated attacker holding the "services" permission to inject arbitrary shell commands executed as root through the set cifs password CLI command, which passes unsanitized input directly to a system() call. Successful exploitation yields complete loss of confidentiality, integrity, and availability on the appliance and may propagate to downstream serial-attached devices, warranting the CVSS v3.1 score of 9.1.

Technical Analysis

The vulnerability resides in the CLI/terminal management interface of Lantronix console servers. The affected command is set cifs password, exposed to users possessing the "services" permission level. Per the NVD description, this command "passes unsanitized user input to a system() call." This is a textbook CWE-78 OS Command Injection pattern: user-supplied input is concatenated into a shell command string that is then handed to system() for execution under the privileges of the calling process — which, in this context, is root.

Because the injection point is a parameter of an administrative CLI command rather than an HTTP endpoint, the attack surface is the terminal/CLI login interface (SSH, serial console, or telnet depending on device configuration). The exploitation prerequisite is an authenticated session with the services permission, which lowers the "attack complexity" barrier for an insider or a holder of valid low/medium-privilege credentials, but the impact is total due to the root execution context.

The CVSS vector confirms network reachability (AV:N), low complexity (AC:L), high privileges required (PR:H, reflecting the authenticated services permission), no user interaction (UI:N), and a scope change (S:C) — the vulnerable component can affect resources beyond its own security authority (i.e., downstream serial-attached devices reachable through the console server). C/I/A impacts are all rated High.

Note: no public exploit code, Nuclei template, or PoC is currently available via tracked sources; the analysis below is derived strictly from the NVD description and vulnerability class.

Exploitation Scenarios

1. Reconnaissance / target identification. An attacker identifies Lantronix console servers reachable on the network, e.g., via Shodan queries using product:"Lantronix" or http.html:"Lantronix" / http.title:"SLC", or by scanning corporate management VLANs for known Lantronix management interfaces (web, telnet, SSH). The attacker notes the exposed terminal/CLI service.

2. Authentication and privilege check. The attacker authenticates to the terminal or CLI interface using valid credentials that carry the services permission. This may be obtained through credential reuse, a phished insider, or a compromised low-privilege account — but the services permission is required (PR:H).

3. Vulnerability-class trigger. Within the authenticated CLI session, the attacker invokes the set cifs password command and supplies a crafted value as the password argument. Because the application fails to sanitize this input before passing it to a system() call, shell metacharacters in the supplied value cause the underlying shell to interpret and execute additional commands. The specific delimiter and payload syntax are not documented in the NVD entry; at the vulnerability-class level, this is a classic shell injection where command separators (e.g., ;, |, &&, backticks, or $()) embedded in the password field break out of the intended command context.

4. Post-exploitation impact. Injected commands execute with root privileges on the appliance. The attacker gains full control of the console server: reading/writing configuration, accessing stored credentials and connection logs, disabling auditing, and pivoting through the appliance's serial connections to attack downstream devices (servers, routers, switches, OT equipment) that trust the console server as a management path. This matches the CVSS scope-change finding (S:C), the High confidentiality/integrity/availability subscores, and the stated "complete loss of confidentiality, integrity, and availability."

No public PoC is available; the exact payload string and the required CLI interaction sequence are inferred from the command-injection vulnerability class and cannot be specified further without vendor documentation.

Impact Assessment

• Blast radius: Enterprise and industrial environments using Lantronix console servers for out-of-band management of network, server, and OT infrastructure. Affected models include SLC8000 (< v9.7.0.2), EMG8500/EMG7500 (< v9.7.0.1), and all firmware versions of SLB882, SLCx-03, and SLCx-02.
• CVSS v3.1 subscores: AV:N (network-reachable), AC:L (no specialized conditions), PR:H (authenticated services permission required), UI:N, S:C (impact crosses into downstream serial-attached devices), C:H/I:H/A:H. Base score 9.1 — Critical.
• Business impact: Root compromise of a management plane can translate into full-fleet compromise via console-attached serial paths, enabling configuration tampering, credential theft, persistent backdoors, service disruption, and safety-system interference in OT settings. The scope change means incident scoping is difficult: downstream devices may need to be treated as potentially compromised.
• Exploitability: No weaponized public exploit, Nuclei template, or CISA KEV listing is present. EPSS is not yet scored by FIRST.org. However, the low complexity of the class, the root execution context, and the broad deployment of console servers make this a high-priority patch candidate despite the absence of observed exploitation.

Detection Guidance

Sigma Rule

Detects suspicious CLI command input containing shell metacharacters targeting the vulnerable set cifs password command, and anomalous root shell spawns from management processes.

title: Lantronix Console Server CVE-2026-80145 Command Injection Attempt
id: 8f9a2c14-7bd6-4c3a-9e21-1d4f6a8b2e70
status: experimental
description: Detects shell metacharacters in Lantronix CLI 'set cifs password' input, indicative of CVE-2026-80145 command injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-80145
author: valtersit.com
logsource:
  product: lantronix
  service: cli
detection:
  keywords:
    - 'set cifs password'
  metachars:
    - ';'
    - '|'
    - '&&'
    - '`'
    - '$('
  condition: keywords and metachars
fields:
  - user
  - src_ip
  - command
falsepositives:
  - Legitimate complex passwords containing shell metacharacters (rare for this field)
level: critical

YARA Rule

rule CVE_2026_80145_Lantronix_Command_Injection
{
    meta:
        author      = "valtersit.com"
        description = "Detects suspicious set cifs password invocation with shell metacharacters in Lantronix CLI/log artifacts"
        cve         = "CVE-2026-80145"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-80145"
        date        = "2026-01-01"

    strings:
        $cmd = "set cifs password" ascii nocase wide
        $m1  = ";" ascii
        $m2  = "`" ascii
        $m3  = "$(" ascii
        $m4  = "&&" ascii
        $m5  = "||" ascii

    condition:
        $cmd and any of ($m*)
}

Suricata IDS Rule

Detects network transport of the vulnerable CLI command combined with injection metacharacters to a Lantronix management interface.

alert tcp $HOME_NET any -> $HOME_NET [22,23,80,443] (msg:"CVE-2026-80145 Lantronix set cifs password command injection attempt"; flow:to_server,established; content:"set cifs password"; nocase; ascii; pcre:"/set\s+cifs\s+password[^\r\n]*[;&|`]|\$\(/i"; reference:cve,2026-80145; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-80145; classtype:attempted-admin; sid:202680145; rev:1;)

Elastic Detection

Monitors for CLI authentication/invocation events to Lantronix appliances where the set cifs password command contains shell metacharacters.

sequence by host.id
  [process where event.action == "start" and process.name in ("ssh", "telnet") and
     destination.port in (22, 23)]
  [process where event.type == "start" and process.args : "*set cifs password*" and
     (process.args : "*;*" or process.args : "*`*" or process.args : "*$(*" or process.args : "*&&*")]

Splunk SPL Query

Searches CLI/syslog or network telemetry for the vulnerable command combined with injection metacharacters.

index=lantronix OR index=net_flow (sourcetype=lantronix:cli OR sourcetype=syslog)
| eval cmd=coalesce(command, _raw)
| where match(cmd, "(?i)set\s+cifs\s+password")
| where match(cmd, "[;`&|]|\\$\\(")
| table _time, host, user, src_ip, cmd
| sort - _time

Wazuh OSSEC Rule

Custom Wazuh decoder/rule matching CLI or auth logs containing the injected command pattern.

<group name="lantronix,cve-2026-80145,">
  <rule id="100815" level="14">
    <decoded_as>syslog</decoded_as>
    <match>set cifs password</match>
    <regex type="pcre2">(?i)set\s+cifs\s+password[^\r\n]*[;&amp;|`]|\$\(</regex>
    <description>CVE-2026-80145: Lantronix 'set cifs password' command injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>command_injection,attempted_admin,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network access to Lantronix CLI/terminal interfaces (SSH, telnet, serial) to a hardened, isolated management VLAN with strict ACLs and jump-host enforcement.
   • Enforce least privilege: audit and minimize the number of accounts granted the services permission. Remove stale, shared, or default credentials.
   • Monitor and alert on invocation of set cifs password and any shell metacharacters in CLI command inputs (see detection rules above).
   • Where the CLI is not required, disable telnet and restrict SSH to specific source IPs. Bind management interfaces to internal-only address space.
   • Treat affected SLB882, SLCx-03, and SLCx-02 devices as unfixable via firmware and plan compensating controls or replacement.

2. Patch/upgrade steps

   • For SLC8000, upgrade to firmware v9.7.0.2 or later (per NVD description).
   • For EMG8500/EMG7500, upgrade to firmware v9.7.0.1 or later (per NVD description).
   • For SLB882, SLCx-03, and SLCx-02: no fixed firmware version is identified in the CVE data; contact Lantronix for guidance and apply compensating controls until a fix is published.
   • Verify current firmware versions before and after upgrade, and rerun detection rules to confirm clean state.

3. Long-term hardening

   • Enforce multi-factor authentication on all console-server management access.
   • Centralize syslog to an immutable SIEM; ensure CLI command logging captures full command arguments.
   • Segment console servers so that a compromised appliance cannot freely pivot to serial-attached OT/ICS or core infrastructure without additional authentication.
   • Maintain an asset inventory of Lantronix devices and subscribe to vendor advisories for CVE-2026-80145 patch availability.
   • Apply input-validation hardening at the management-plane boundary via compensating proxies/commands where vendor code cannot be updated.

References

• NVD — CVE-2026-80145: https://nvd.nist.gov/vuln/detail/CVE-2026-80145
• CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Lantronix Product Security / Advisory Portal (consult for firmware v9.7.0.2 / v9.7.0.1 release notes and future advisories)
• FIRST EPSS — not yet scored for this CVE as of the time of writing (no exploit-prediction value available)

No threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-80145 per the provided intelligence; CISA KEV status is NO, and no public PoC, Nuclei template, or exploit code exists in tracked sources.