CVE-2026-80147

Executive Summary

CVE-2026-80147 is a stack-based buffer overflow (CWE-121) in Lantronix out-of-band management and serial console devices. An authenticated attacker who can reach the terminal or CLI interface — using credentials of any privilege level — can send an oversized input to an undocumented mfc eeprom write command, which copies unbounded user input into a bounded stack buffer before it is passed to a system() call, enabling potential arbitrary code execution. Because the exploited process executes with device-level privileges, successful exploitation yields complete loss of confidentiality, integrity, and availability (CVSS 9.9) and can pivot to downstream serial-attached infrastructure; SLB882, SLCx-03, and SLCx-02 have no fix available at any firmware version.

Technical Analysis

The vulnerability resides in the command-processing path of the device CLI/terminal interface. Per the NVD description, the affected component is an undocumented mfc eeprom write command. This command accepts user-supplied input, copies that input into a fixed-size stack buffer without bounds checking, and subsequently passes the (corrupted) value to a system() call. This is the classic CWE-121 stack-based buffer overflow pattern with an aggravating secondary factor: the unbounded data flows not only into a stack buffer but onward into a shell invocation.

Attack surface and preconditions:

• Interface: terminal or CLI interface exposed by the device (serial console, SSH, or telnet management plane).
• Authentication requirement: PR:L — the attacker must be authenticated, but the description explicitly states any user account is sufficient, meaning no administrative privilege is required. This significantly widens the attacker pool (e.g., a low-privilege operator, a leaked credential, or a default/weak account).
• Network reachability: AV:N — the interface is reachable over the network.
• Scope: S:C — the vulnerable component's failure affects resources beyond its own security scope, consistent with downstream serial-attached device impact.

Mechanism, at the vulnerability-class level:

1. An authenticated session submits an oversized argument to the mfc eeprom write command.
2. The handler performs a strcpy/memcpy-style copy of the user input into a bounded stack buffer (exact buffer size and function names are not disclosed in the source data and are therefore not asserted here).
3. Overflow corrupts adjacent stack memory, including the saved return address and/or control data.
4. Because the value is subsequently handed to system(), the crafted input can influence a shell command context, providing a direct path to command execution.

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE. The mechanism above is inferred strictly from the vulnerability class and the NVD description; no specific function names, offsets, or URL paths beyond mfc eeprom write are provided by the source data. EPSS has not scored this CVE; no exploit-in-the-wild evidence is recorded, and the CVE is not listed in CISA KEV.

Exploitation Scenarios

Step 1 — Reconnaissance / target identification. An attacker enumerates internet- or LAN-exposed Lantronix management interfaces (serial console servers, OOB management appliances). Fingerprinting is achievable via HTTP titles, banner grabs, or MAC/OUI on the management VLAN. Shodan queries such as http.title:"SLC" or http.html:"Lantronix" surface candidate devices.

Step 2 — Authentication. The attacker obtains any valid account. Given the PR:L classification and the any user condition, vectors include default credentials, credential reuse from a breach, a low-privilege service account, or social engineering. No admin role is required.

Step 3 — Triggering the flaw. Over the terminal/CLI session, the attacker issues the undocumented mfc eeprom write command with an input string substantially longer than the internal stack buffer. The handler copies the unbounded input into the bounded buffer without validation (no explicit length/terminator check per the description), producing the overflow. (No specific byte count, delimiter, or argument syntax is published; attackers would fuzz the command to determine the exact overflow offset.)

Step 4 — Payload / execution (class-level). The overflow corrupts stack control data. Because the description notes the data is passed to a system() call, the attacker's goal is to influence that shell invocation or redirect execution — the vulnerability class permits arbitrary code execution in the privilege context of the device process, which on embedded firmware is typically root. As no PoC is public, the precise payload construction is not documented and is not invented here.

Step 5 — Post-exploitation impact. With code execution at device privilege, the attacker gains full control of the appliance: manipulation of serial sessions, exfiltration of configuration/credentials, establishment of persistence, and lateral movement to downstream serial-attached devices (network gear, industrial controllers, PBX, or servers whose console is proxied by the appliance). CVSS C:H/I:H/A:H and S:C capture this complete, cross-boundary compromise.

Impact Assessment

• Confidentiality (C:H): Attackers can read device configuration, stored credentials, and data traversing managed serial sessions.
• Integrity (I:H): Firmware/config modification, arbitrary command execution, and tampering with the OOB management path.
• Availability (A:H): Device instability, crash, or full denial of the management/console function — critical because these appliances are often the last-resort recovery path when primary networks are down.
• Scope (S:C): The blast radius extends beyond the device itself to every system whose console/management access is brokered by the appliance.
• Business impact: Out-of-band management appliances are high-value targets in OT, industrial, healthcare, retail, and branch-network environments. Compromise yields a durable foothold on a trusted management segment and can silently interpose on administrative sessions.

Affected systems: Lantronix SLC8000 (prior to v9.7.0.2), EMG8500/EMG7500 (prior to v9.7.0.1), and all firmware versions of SLB882, SLCx-03, and SLCx-02. The lack of any fix for the latter three raises indefinite risk.

Detection Guidance

Sigma Rule

title: Lantronix mfc eeprom write Buffer Overflow Attempt
id: 3f5c9a21-8b7e-4d2a-9c11-6a4f0e7b8a91
status: experimental
description: Detects CLI/terminal command usage invoking the undocumented 'mfc eeprom write' command with abnormally long arguments, indicative of CVE-2026-80147 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-80147
author: valtersit.com
logsource:
  product: lantronix
  service: cli
detection:
  selection_cmd:
    command|contains: 'mfc eeprom write'
  selection_long:
    command|re: 'mfc eeprom write.{200,}'
  condition: selection_cmd or selection_long
falsepositives:
  - Legitimate firmware maintenance scripts issuing documented commands
level: high
tags:
  - attack.t1190
  - cve.2026-80147

YARA Rule

rule CVE_2026_80147_Lantronix_mfc_eeprom_write
{
    meta:
        description = "Detects references to the undocumented mfc eeprom write command associated with CVE-2026-80147"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-80147"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cmd1 = "mfc eeprom write" ascii nocase
        $cmd2 = "mfc eeprom" ascii nocase
        $cmd3 = "eeprom write" ascii nocase

    condition:
        any of them
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-80147 Lantronix mfc eeprom write overflow attempt"; flow:to_server,established; content:"mfc eeprom write"; nocase; content:"|0A|"; within:512; pcre:"/mfc\s+eeprom\s+write[\s\x00-\x7f]{200,}/i"; classtype:attempted-admin; reference:cve,2026-80147; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-80147; sid:202680147; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=10s
  [process where process.name in ("cli","sh","tty") and process.command_line : "mfc eeprom write"]
  [process where process.command_line : "mfc eeprom write*" and length(process.command_line) > 256]

Splunk SPL Query

index=network OR index=cli
| eval cli_cmd = coalesce(command, raw)
| where like(lower(cli_cmd), "%mfc eeprom write%")
| eval arg_len = len(cli_cmd)
| stats count min(arg_len) as min_len max(arg_len) as max_len by src_ip, dest_ip, host
| where max_len > 256
| table src_ip dest_ip host count min_len max_len

Wazuh OSSEC Rule

<group name="lantronix,cve-2026-80147,">
  <rule id="202680147" level="12">
    <decoded_as>json</decoded_as>
    <field name="command">mfc eeprom write</field>
    <regex type="pcre2">mfc\s+eeprom\s+write.{200,}</regex>
    <description>CVE-2026-80147: Suspicious 'mfc eeprom write' overflow attempt against Lantronix device.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD entry names firmware thresholds (SLC8000 v9.7.0.2; EMG8500/EMG7500 v9.7.0.1) that address the flaw, but no vendor advisory, patch URL, or CVE-recorded remediation is confirmed by tracked sources, and SLB882/SLCx-03/SLCx-02 remain affected across all firmware versions.

1. Immediate mitigations

   • Restrict management-plane access to a hardened, isolated OOB VLAN; block internet exposure of CLI/SSH/telnet/HTTP management interfaces.
   • Enforce least privilege and remove or disable unused/low-privilege accounts — the flaw requires only any authenticated user.
   • Rotate credentials and eliminate default or shared passwords.
   • Monitor/alert on any use of the mfc eeprom write command and on abnormally long command lines at the CLI.
   • Where the command cannot be disabled, apply command-level access restrictions if the platform supports it.

2. Patch / upgrade steps

   • For SLC8000: upgrade to firmware v9.7.0.2 or later.
   • For EMG8500/EMG7500: upgrade to firmware v9.7.0.1 or later.
   • For SLB882, SLCx-03, and SLCx-02: no fixed firmware exists; treat as permanently risky — compensate with network isolation and enhanced monitoring, and consider hardware replacement or vendor engagement for a timeline.
   • Validate the vendor authenticity of any firmware package before flashing.

3. Long-term hardening

   • Segment all serial/OOB appliances onto dedicated management networks with strict ACLs and no inbound internet.
   • Centralize logging of CLI activity to a SIEM and alert on the detection rules above.
   • Track Lantronix security advisories and CISA resources for an eventual fix to the SLB882/SLCx-03/SLCx-02 family.
   • Inventory serial-attached downstream devices and assume they are reachable if the appliance is compromised.

References

• NVD — CVE-2026-80147: https://nvd.nist.gov/vuln/detail/CVE-2026-80147
• CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• Lantronix product/security support portal (SLC8000, EMG8500/EMG7500, SLB882, SLCx-03/-02 firmware downloads and advisories)
• CISA Known Exploited Vulnerabilities catalog — CVE-2026-80147 is NOT listed as of this report; no KEV entry applies.
• No public proof-of-concept, exploit code, or Nuclei template is known at time of writing; no threat-actor campaign or in-the-wild exploitation evidence is recorded.