CVE-2026-80148

Executive Summary

CVE-2026-80148 is a server-side request forgery (SSRF) vulnerability affecting Lantronix SLC8000, EMG8500/EMG7500, and SLB882 console/management appliances. It resides in the WebSSH/WebTelnet listener — a custom build of shellinaboxd — which constructs SSH connection targets using an snprintf call incorporating user-supplied input. An unauthenticated attacker can supply an overlong username string that truncates the device IP suffix, causing the appliance to open the resulting SSH connection to an arbitrary, attacker-controlled host instead of the intended local target.

The vulnerability carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting unauthenticated, network-reachable exploitation with a scope change and high confidentiality impact. The primary risk is not direct device compromise but abuse of the appliance as an internal network pivot point: attackers can coerce the device into enumerating or communicating with internal endpoints that are otherwise unreachable from the internet. No public PoC or exploit code is known, and the CVE is not listed in CISA KEV.

Technical Analysis

The affected component is the WebSSH/WebTelnet listener, implemented via a custom build of the shellinaboxd web terminal gateway. Per the NVD description, the flaw lies in how the SSH connection target string is assembled:

• The target (host plus the device's own IP suffix) is built with an snprintf call that embeds user-supplied input.
• By supplying an overlong username string, the attacker causes the device IP suffix portion of the assembled target to be truncated.
• With the local device IP suffix removed, the truncated string resolves to an arbitrary host controlled by the attacker (or to any host the attacker names), and the appliance initiates an SSH connection to that endpoint.

This is a classic string-truncation-induced target confusion. snprintf bounds the total bytes written but returns/writes a truncated result; when the truncated result is subsequently parsed as a host or host:port, the parser interprets the altered string as a different destination. The trust boundary failure is that user-controlled data (the username field offered by the WebSSH/WebTelnet interface) is concatenated into a connection-target string without validation, length constraints, or separation from the trusted internal target fragment.

Affected attack surface: the WebSSH/WebTelnet web listener on the three product families. Because exploitation occurs with PR:N and UI:N (no privileges, no user interaction), the listener is reachable to unauthenticated parties wherever it is exposed.

Impact of the truncation flaw: the appliance — which typically sits inside an OT/industrial or network operations segment — becomes a relay. The attacker does not gain a shell on the device from this bug alone; the demonstrated impact is that the device performs SSH connections to endpoints of the attacker's choosing, enabling internal endpoint enumeration and communication ("SSRF-style" internal pivoting). The C/I/A vector (C:H/I:N/A:N) and scope change (S:C) confirm the confidentiality-focused, cross-boundary nature of the flaw.

Patch status: Patch confidence 0/4. No patch evidence was found from any tracked source at publication time; the affected-version data is derived directly from the NVD description. There is no vendor fix link, workaround note, or OSV package mapping in the supplied intelligence. This means defenders must assume all SLC8000 units below v9.7.0.3, EMG8500/EMG7500 units below v9.7.0.1, and every SLB882 unit remain exposed until vendor confirmation is obtained.

Exploitation Scenarios

No public PoC exists for this CVE; the chain below is inferred from the documented vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker locates exposed Lantronix appliances with the WebSSH/WebTelnet interface reachable — typically via internet-wide scanning (Shodan/Censys) or direct knowledge of a target's management network. Lantronix SLC/EMG/SLB devices are commonly deployed as console servers and out-of-band management gateways, so their web listeners are often internet-exposed or reachable from VPN segments.

2. Triggering the flaw. The attacker accesses the WebSSH/WebTelnet listener and supplies input to the username parameter with a deliberately overlong value. Because the listener builds the SSH connection target via snprintf using this input, the overlong username causes the local device IP suffix to be truncated from the assembled target.

3. Redirecting the connection. With the trusted IP suffix removed, the malformed target string is interpreted as a different destination. The attacker arranges for this resulting host to be an endpoint they control. The appliance then establishes an SSH connection to that attacker-controlled endpoint instead of the intended local target.

4. Post-exploitation impact. The device acts as an internal SSH relay/probe: the attacker can direct it to enumerate or communicate with internal network endpoints that would otherwise be inaccessible. This supports internal reconnaissance (host liveness, SSH banner/service fingerprinting) and outbound communication from a trusted internal vantage point. Crucially, exploiting this flaw does not by itself grant the attacker a shell on the Lantronix device — the NVD data records no integrity or availability impact; the value of the bug is its use as an SSRF pivot from a device that sits inside a protected network segment.

Impact Assessment

• Confidentiality: High (C:H). The appliance can be coerced into connecting to arbitrary hosts, enabling internal endpoint enumeration and communication using the device's own network position and trust.
• Integrity: None (I:N), Availability: None (A:N). The flaw does not modify or disrupt the device per the CVSS subscores.
• Scope: Changed (S:C). Impact crosses the security boundary from the Lantronix device into other internal systems.
• Attack prerequisites: AV:N / AC:L / PR:N / UI:N. Remotely exploitable, low complexity, no authentication, no user interaction. This is the worst-case accessibility profile for a management appliance.
• Blast radius. Any Lantronix SLC8000 (< 9.7.0.3), EMG8500/EMG7500 (< 9.7.0.1), and all SLB882 devices with the WebSSH/WebTelnet listener enabled. These devices frequently act as the out-of-band management entry point into OT/IT networks, so a successful SSRF pivot can expose segments that are otherwise unreachable.

Business impact: the affected appliances are often the last-resort management path for network gear, servers, and industrial equipment. Turning one into an internal relay offers attackers a trusted-looking pivot for internal reconnaissance and lateral movement planning. Combined with the unauthenticated, no-interaction exploit profile, this creates a standing exposure for any organization relying on Lantronix console servers.

Detection Guidance

Sigma Rule

title: Lantronix WebSSH/WebTelnet SSRF Target Truncation Attempt
id: 7d3f2c91-4a5e-4b8c-9f01-2e6a5c7d8b31
status: experimental
description: Detects requests to Lantronix WebSSH/WebTelnet listener containing overlong username parameters consistent with CVE-2026-80148 SSRF target truncation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-80148
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - 'shellinabox'
      - 'webssh'
      - 'webtelnet'
  selection_len:
    cs-uri-query|re: '(?i)(username|user|login)=.{120,}'
  condition: selection_path and selection_len
fields:
  - c-ip
  - cs-uri-query
  - cs-uri-stem
falsepositives:
  - Legitimate but unusually long usernames (rare)
level: high
tags:
  - attack.t1190
  - cve.2026.80148

YARA Rule

rule CVE_2026_80148_Lantronix_WebSSH_SSRF
{
    meta:
        description = "Detects exploitation attempts against Lantronix WebSSH/WebTelnet SSRF target truncation (CVE-2026-80148)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-80148"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a = "shellinabox" nocase
        $b = "WebSSH" nocase
        $c = "WebTelnet" nocase
        $u1 = "username=" nocase
        $u2 = "user=" nocase
        $ssh = "ssh://"

    condition:
        filesize < 5MB and
        (any of ($a, $b, $c)) and
        (any of ($u1, $u2)) and
        #u1 > 0 or #u2 > 0
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-80148 Lantronix WebSSH/WebTelnet SSRF Attempt - Overlong Username"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"username="; nocase; pcre:"/(username|user)=[^\&\x20]{120,}/i"; http.uri; content:"shellinabox"; nocase; threshold: type limit, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-80148; metadata:affected_product Lantronix_SLC8000_EMG8500_EMG7500_SLB882, attack_target Networking_Device, deployment Internal, signature_severity Major; sid:9000148; rev:1;)

Elastic Detection

network where
  network.protocol == "http" and
  (
    url.path like~ "*shellinabox*" or
    url.path like~ "*webssh*" or
    url.path like~ "*webtelnet*"
  ) and
  (
    string(url.query) like~ "*username=*" or
    string(url.query) like~ "*user=*"
  ) and
  length(string(url.query)) >= 130

Splunk SPL Query

index=web OR index=proxy OR index=firewall
| eval q=coalesce(uri_query, cs_uri_query, url)
| where (like(uri_path, "%shellinabox%") OR like(uri_path, "%webssh%") OR like(uri_path, "%webtelnet%") OR like(q, "%username=%"))
| regex q="(?i)(username|user)=[^\&\s]{120,}"
| rex field=q "(?i)(?<param>(username|user))=(?<val>[^&]+)"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by param host
| where count > 0

Wazuh OSSEC Rule

<group name="web,lantronix,">
  <rule id="100148" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>shellinabox|webssh|webtelnet</match>
    <regex>(?i)(username|user)=[^\&\s]{120,}</regex>
    <description>CVE-2026-80148: Lantronix WebSSH/WebTelnet SSRF attempt - overlong username parameter detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_80148,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED, no patch evidence from any tracked source at publication.

1. Immediate mitigations.

   • Remove internet exposure of the WebSSH/WebTelnet listener. Restrict access to a hardened management VLAN or behind an authenticated jump host.
   • Disable the WebSSH/WebTelnet interface entirely if remote serial-over-SSH access is not operationally required.
   • Apply network egress filtering on the management segment so appliances cannot initiate outbound SSH to arbitrary hosts; allow only explicitly required destination IPs.
   • Enforce a maximum username length at any front-end reverse proxy or WAF sitting in front of the WebSSH/WebTelnet endpoint.

2. Patch / upgrade steps (from the NVD affected-version data).

   • SLC8000: upgrade to firmware v9.7.0.3 or later.
   • EMG8500 / EMG7500: upgrade to firmware v9.7.0.1 or later.
   • SLB882: no fixed firmware version is identified in the advisory data; treat all SLB882 units as vulnerable and isolate accordingly until vendor guidance is obtained. Contact Lantronix support for a firmware roadmap.

3. Long-term hardening.

   • Inventory all Lantronix console/management appliances and map firmware versions against the thresholds above.
   • Disable unused services (WebSSH, WebTelnet, unused web listeners) by default in device baseline hardening.
   • Enforce outbound allowlisting from management/OT segments to prevent SSRF-class pivots generally.
   • Monitor for future vendor advisory updates; because no fix link or OSV mapping exists, track Lantronix security advisories directly.

References

• NVD — CVE-2026-80148: https://nvd.nist.gov/vuln/detail/CVE-2026-80148
• CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Lantronix official security advisory portal (vendor guidance for SLC8000, EMG8500/EMG7500, SLB882 firmware): https://www.lantronix.com/support/
• CISA KEV Catalog (CVE-2026-80148 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-80148 at the time of writing; the CVE is not listed in CISA KEV, no public PoC or exploit code exists, and no Nuclei template is available.