CVE-2026-80146

Executive Summary

CVE-2026-80146 is a stack-based buffer overflow (CWE-121) in Lantronix serial console managers and device management appliances, including the SLC8000, EMG8500/EMG7500, and the legacy SLB882/SLCx-03/SLCx-02 lines. The flaw is reachable by any authenticated user through an undocumented mfc eeprom read command exposed on the terminal or CLI interface, which copies unbounded user input into a fixed-size stack buffer before passing the result to system(). Successful exploitation can yield arbitrary code execution with the privileges of the management process, resulting in complete loss of confidentiality, integrity, and availability on the appliance and, by extension, on serial-attached downstream devices.

Technical Analysis

The root cause is a classic unbounded copy into a stack-allocated buffer (CWE-121, Stack-based Buffer Overflow). Per the NVD description, the vulnerable code path is triggered by an undocumented mfc eeprom read command. This command is a CLI/terminal-level administrative surface, meaning the attacker must first authenticate — reflected in the CVSS vector's PR:L (Privileges Required: Low), where "low" here means any valid user account rather than an administrative one.

The attack flow described in the advisory is:

1. Input is accepted via the mfc eeprom read command arguments or its interactive prompt.
2. That input is copied into a bounded stack buffer without a length check ("copies unbounded user input into a bounded stack buffer").
3. The overflow corrupts adjacent stack memory, which can overwrite a saved return address and/or an adjacent pointer.
4. Critically, the buffer content is then passed to a system() call, providing a direct path from memory corruption to command execution. Because system() invokes a shell, control-flow hijack or argument manipulation of that call both converge on arbitrary command execution.

Two attributes elevate severity. First, the S:C (Scope: Changed) metric: once code execution is achieved, the compromise can pivot beyond the management process to affect the wider appliance and its serial-attached devices, which is why all three CIA metrics are rated High. Second, the preconditions are weak: AV:N means the CLI is network-reachable (SSH/Telnet-style console access typical of console managers), AC:L means no race condition or special environment is needed, and UI:N means no victim interaction is required. The only barrier is possessing any valid credential.

The mfc eeprom read command is undocumented, which implies it is not part of the standard published CLI reference and will not appear in normal administrative runbooks. This reduces the likelihood of casual discovery via documentation review but increases risk from adversarial reverse engineering of firmware images, which are freely downloadable for these product lines. No public PoC, exploit code, or Nuclei template exists at the time of writing; the technical chain below is therefore inferred from the vulnerability class and the vendor/CNA description.

Affected firmware boundaries are explicit for two families — SLC8000 before v9.7.0.2 and EMG8500/EMG7500 before v9.7.0.1 — while SLB882, SLCx-03, and SLCx-02 are stated to be vulnerable across all firmware versions, with no fixed release identified. That third group should be treated as permanently unpatched until Lantronix publishes an advisory indicating otherwise.

Exploitation Scenarios

1) Reconnaissance / target identification. An attacker enumerates internet-exposed or laterally reachable Lantronix console managers using Shodan-style queries (e.g., http.html:"SLC8000", http.title:"Lantronix", product:"Lantronix SLC"). Console managers are frequently deployed on out-of-band (OOB) management networks and are commonly reachable at the network perimeter because they are used for remote recovery of routers, switches, and servers. The attacker confirms model and firmware revision via the web UI login banner, SSH banner, or SNMP sysDescr.

2) Credential acquisition. Because the flaw requires authentication (PR:L), the attacker obtains any valid user account. Realistic vectors include default or shared credentials common on OOB appliances, credential reuse harvested from unrelated breaches, credentials exposed in device configuration backups, or password reuse by a low-privileged operator. Administrative privilege is explicitly not required — the mfc eeprom read command is reachable by any authenticated user.

3) Triggering the overflow. The attacker authenticates to the terminal or CLI interface (serial console, SSH, or Telnet service exposed by the device) and invokes the undocumented mfc eeprom read command, supplying an oversized input. The input is copied into a fixed-size stack buffer with no bounds enforcement, overwriting saved stack state. No victim interaction is needed; the attacker drives the entire sequence (UI:N), and the lack of race conditions or environment dependencies (AC:L) means the attack is highly repeatable and automatable.

4) Payload and execution. Because the overflowed buffer is subsequently handed to a system() call, the exploitation primitive is either (a) stack-smashing to redirect execution, or (b) manipulating the string that reaches system() so the invoked command contains attacker-chosen shell syntax. Either path terminates in command execution under the privileges of the CLI/management process — typically a privileged service account on the appliance. No specific function names, offsets, or gadget chains are asserted here; those details are not present in the available advisory data, and no public exploit exists to confirm them.

5) Post-exploitation impact. With shell-level access on the appliance, the attacker can read stored credentials, modify the device configuration, and use the console manager's own trust relationships to pivot to serial-attached network gear. The S:C metric reflects exactly this: the compromise is not confined to the vulnerable process. Serial-attached devices typically trust the console manager's connection and may accept privileged configuration commands over that link, allowing unauthorized reconfiguration, persistent implanting, or denial of service on downstream infrastructure.

No public PoC is available; the attack chain above is inferred from the vulnerability class and the description supplied by the CNA.

Impact Assessment

Business impact. Serial console managers and EMG appliances are the "break-glass" access path for data-center, industrial, and telecom infrastructure. Compromise of one of these devices is a high-value objective because it grants a foothold on the management plane and, via serial attachments, a direct path to routers, switches, firewalls, and OT endpoints. An attacker with code execution on the appliance can silently alter device configurations, harvest stored credentials, disable logging, or sever out-of-band recovery — meaning that after a compromise, the security team may lose the very channel it needs to remediate the incident.

CVSS interpretation. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9 Critical. AV:N and AC:L indicate the flaw is remotely reachable and trivially triggerable once credentials exist. PR:L caps the base score below 10.0 solely because any authenticated account suffices — but because these appliances frequently ship with default or weakly managed credentials, PR:L should not be treated as a meaningful barrier in practice. UI:N means exploitation is fully attacker-driven and scriptable. S:C confirms the security scope expands beyond the vulnerable component: impact is not contained to the CLI process but propagates to the appliance and its downstream serial devices, which is why all three CIA impacts are rated High.

Blast radius. Directly affected: SLC8000 (all firmware < v9.7.0.2), EMG8500/EMG7500 (all firmware < v9.7.0.1), and SLB882, SLCx-03, SLCx-02 (all firmware versions). Secondary victim set: every device cabled to the affected appliance's serial ports, plus any system whose credentials or configuration are stored on the appliance. Because the legacy SLB882/SLCx-03/SLCx-02 units have no identified fixed firmware, they represent an indefinite-risk population that remediation cannot address by patching.

Exploitability posture. EPSS has not yet been scored by FIRST.org, so no probabilistic exploitation estimate is available. There is no CISA KEV listing, no public PoC, and no Nuclei template. The absence of weaponization at the time of writing lowers near-term risk but should not be relied upon: the prerequisite is only a valid low-privileged credential, and the disclosure itself provides enough detail (command name, overflow class, system() sink) for a competent reverse engineer to reconstruct the trigger from publicly downloadable firmware.

Detection Guidance

Sigma Rule

title: Lantronix SLC/EMG Undocumented 'mfc eeprom read' Command Abuse
id: 8f2c1d64-3b7e-4a9f-9c1d-7a5e2f0b6d31
status: experimental
description: Detects authenticated invocation of the undocumented 'mfc eeprom read' CLI command associated with CVE-2026-80146 stack-based buffer overflow.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-80146
author: valtersit.com
date: 2026/01/01
logsource:
  product: lantronix
  service: cli
detection:
  selection_cmd:
    command|contains: 'mfc eeprom read'
  selection_long_arg:
    command|re: 'mfc\s+eeprom\s+read\s+.{64,}'
  condition: selection_cmd or selection_long_arg
falsepositives:
  - Legitimate diagnostic use by vendor support engineers
level: high

YARA Rule

rule CVE_2026_80146_Lantronix_MFC_EEPROM_CMD
{
    meta:
        author = "valtersit.com"
        description = "Detects firmware/CLI artifacts referencing the undocumented 'mfc eeprom read' command linked to CVE-2026-80146"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-80146"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cmd1 = "mfc eeprom read" ascii nocase
        $cmd2 = "eeprom read" ascii nocase
        $ver1 = "SLC8000" ascii nocase
        $ver2 = "EMG8500" ascii nocase
        $ver3 = "EMG7500" ascii nocase
        $ver4 = "SLB882" ascii nocase
        $sys  = "system" ascii fullword

    condition:
        ($cmd1 or $cmd2) and
        any of ($ver*) and
        filesize < 50MB
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-80146 Lantronix SLC/EMG Undocumented 'mfc eeprom read' Command Attempt"; flow:established,to_server; content:"mfc"; nocase; content:"eeprom"; nocase; distance:0; content:"read"; nocase; distance:0; pcre:"/mfc\s+eeprom\s+read\s+[^\r\n]{64,}/i"; threshold:type both, track by_src, count 1, seconds 60; classtype:attempted-admin; reference:cve,2026-80146; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-80146; sid:202680146; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where event.type == "start" and
     process.name in ("ssh", "telnet", "sshd") and
     process.command_line : "*mfc eeprom read*"]
  [process where event.type == "start" and
     process.name in ("sh", "bash", "sh", "os.system") and
     process.parent.name != null]

Splunk SPL Query

index=cli_logs OR index=network_flows
| eval cmd=lower(coalesce(cli_command, command, raw))
| where match(cmd, "mfc\s+eeprom\s+read")
| eval arg_len=len(cmd)
| where arg_len > 80 OR match(cmd, "mfc\s+eeprom\s+read\s+[a-z0-9]{64,}")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as source_ips
        values(user) as accounts
        max(arg_len) as max_arg_length
  by dest_host dest_ip
| where count >= 1
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="lantronix,cve-2026-80146,">
  <rule id="2026801" level="10">
    <decoded_as>syslog</decoded_as>
    <regex type="pcre2">mfc\s+eeprom\s+read</regex>
    <description>CVE-2026-80146: Undocumented 'mfc eeprom read' command invoked on Lantronix SLC/EMG appliance (possible stack overflow attempt)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>exploit_attempt,pci_dss_6.5.2,</group>
  </rule>

  <rule id="2026802" level="12">
    <if_sid>2026801</if_sid>
    <regex type="pcre2">mfc\s+eeprom\s+read\s+[^\s]{64,}</regex>
    <description>CVE-2026-80146: Oversized input supplied to 'mfc eeprom read' — likely buffer overflow exploitation attempt</description>
    <mitre>
      <id>T1190</id>
      <id>T1068</id>
    </mitre>
    <group>exploit_attempt,</group>
  </rule>

  <rule id="2026803" level="12">
    <if_sid>2026801</if_sid>
    <description>CVE-2026-80146: Command execution following 'mfc eeprom read' overflow (post-exploitation)</description>
    <field name="cli_child_process">sh|bash|busybox</field>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>post_exploitation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations (apply before patching is possible):

• Restrict CLI exposure. Remove internet and general corporate-LAN reachability from the terminal/CLI (SSH/Telnet) and web interfaces of all Lantronix SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, and SLCx-02 devices. Place them on a dedicated out-of-band management VLAN reachable only through a hardened jump host with MFA.
• Eliminate the credential prerequisite. Because the flaw requires only any authenticated account (PR:L), audit every account on these appliances. Remove default, shared, and stale accounts, disable unused accounts, rotate all credentials, and enforce unique strong passwords. Assume any credential exposed in a prior breach permits exploitation.
• Disable unused management services. Turn off Telnet and any legacy remote-management service; permit CLI access only over SSH from the jump host.
• Network-layer detection. Deploy the Suricata rule above at the management-zone boundary to alert on any mfc eeprom read invocation containing an oversized argument. Treat any hit as a potential active compromise attempt rather than a benign diagnostic.
• Compensating segmentation. Isolate serial-attached downstream devices so that a compromised console manager cannot trivially reconfigure trusted routers, switches, or OT endpoints.
• Vendor engagement. Open a support case with Lantronix to confirm a fixed firmware timeline, particularly for the SLB882 and SLCx-02/SLCx-03 families that the advisory does not associate with any fixed version.

2) Patch / upgrade steps:

• For SLC8000: upgrade to firmware v9.7.0.2 or later.
• For EMG8500 / EMG7500: upgrade to firmware v9.7.0.1 or later.
• For SLB882, SLCx-03, and SLCx-02: no fixed firmware version has been identified; all firmware versions are reported as vulnerable. Isolate or decommission these devices, or obtain a vendor-supported replacement, until Lantronix publishes a fixed release.
• Before upgrading, take a configuration backup, schedule a maintenance window (the CLI/console path may restart), verify firmware image integrity against a vendor checksum, and confirm post-upgrade that the mfc eeprom read command is either removed or properly length-checked.
• After upgrading, rotate all credentials again — the appliance's stored secrets must be assumed exposed if exploitation occurred.

3) Long-term hardening:

• Establish a repeatable firmware-patch cadence for all out-of-band infrastructure and track vendor advisories for Lantronix SLC/EMG product lines.
• Enforce least privilege on CLI accounts and remove the ability for non-administrative users to invoke diagnostic or undocumented commands; if the platform cannot enforce this, reduce the population of accounts that can reach the CLI at all.
• Monitor for undocumented command usage via the Sigma/Wazuh rules above, and forward appliance logs to a central SIEM.
• Do not publish the exact firmware revision in login banners or unauthenticated pages.
• Inventory and decommission end-of-life console servers; legacy SLB882/SLCx-03/SLCx-02 devices with no patch path are the highest residual risk.
• Validate detection coverage with a controlled, authorized test in a lab — never against production appliances, given the memory-corruption nature of the flaw.

References

• NVD — CVE-2026-80146: https://nvd.nist.gov/vuln/detail/CVE-2026-80146
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• MITRE CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• FIRST EPSS (score pending at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-80146 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Known threat actor campaigns / exploit-in-the-wild evidence: None currently identified. There is no CISA KEV entry, no public proof-of-concept, no Nuclei template, and no known exploit code for CVE-2026-80146 at the time of writing. The vulnerability is nonetheless highly attractive to espionage and OT-focused intrusion sets given the privileged, break-glass position of serial console managers; network defenders should treat the absence of observed exploitation as an absence of evidence rather than evidence of safety.