CVE-2026-80149

Executive Summary

Lantronix SLC8000, EMG8500/EMG7500 console managers and the SLB882 product contain a server-side request forgery (SSRF) flaw in the WebSSH/WebTelnet listener. An unauthenticated attacker can manipulate the rooturl parameter so the embedded shellinaboxd component resolves its own address to an attacker-selected host, forcing the device to open outbound SSH connections to arbitrary internal or external endpoints. The vulnerability yields no direct confidentiality loss on the device itself but grants a network pivot that bypasses perimeter segmentation — CVSS 8.6 reflects high confidentiality impact to systems reachable through the compromised appliance.

Technical Analysis

The affected Lantronix devices expose a browser-based WebSSH/WebTelnet interface built on a custom build of shellinaboxd. When a client initiates a terminal session, the daemon determines which IP address it should bind or connect to by reading the rooturl parameter supplied in the web connection. The rooturl value is accepted from the request without adequate validation, meaning it is attacker-controlled and is trusted as a source of the daemon's own address for the terminal session.

Because rooturl is used to derive the destination of the SSH terminal connection, an attacker who supplies a value pointing at a host they control (or at any reachable internal IP) causes the appliance to originate an outbound SSH connection to that endpoint. The server-side nature of the request is what makes this CWE-918: the connection is not made by the requesting client, but by the Lantronix appliance itself, using its own network position, routing table, and trust relationships.

The attack surface is the WebSSH/WebTelnet listener. Critically, the flaw is reachable unauthenticated — no credentials are required to influence the rooturl parameter, as reflected by the CVSS vector PR:N (no privileges required) and UI:N (no user interaction). The scope change (S:C) indicates the exploitation impact crosses a security boundary: the vulnerable component (the shellinaboxd listener) is used to affect components beyond its own security authority (arbitrary internal SSH endpoints). Confidentiality impact is rated High (C:H) while integrity and availability impacts are None (I:N/A:N) — consistent with an SSRF that is useful primarily for enumeration and reachability into segmented networks rather than for modifying or disrupting the appliance.

No public proof-of-concept, Nuclei template, or exploit code has been identified for CVE-2026-80149. The attack chain below is therefore described at the vulnerability-class level and derived strictly from the NVD description and the rooturl parameter it explicitly identifies. No function names, class names, file paths, or additional parameters beyond rooturl and the WebSSH/WebTelnet listener should be assumed.

Exploitation Scenarios

1. Reconnaissance / target identification. An attacker locates internet-exposed or internally reachable Lantronix management interfaces whose WebSSH/WebTelnet listeners respond. Console managers such as the SLC8000, EMG8500, and EMG7500 are typically placed at the network edge or in out-of-band management segments, making them attractive SSRF vantage points. Shodan-style fingerprinting for the Lantronix login/terminal interface identifies candidate hosts.

2. Triggering the flaw class. The attacker crafts a web request to the WebSSH/WebTelnet listener in which the rooturl parameter is set to a value of their choosing — for example, an attacker-controlled host or an internal IP address the attacker wishes to probe. Because the custom shellinaboxd uses rooturl to determine its own IP address for the SSH terminal connection, supplying a modified value redirects the terminal connection target away from the device's legitimate context and toward the attacker-selected endpoint. No authentication step is required.

3. Execution / payload method. The "payload" here is the crafted rooturl value delivered in the web connection. There is no memory-corruption payload and no code execution on the appliance; the attacker's objective is to make the device initiate an SSH connection. The device acts as an unwitting SSH client toward the attacker's endpoint or toward an internal target. Attacks can be iterated with different rooturl values to map reachable hosts.

4. Post-exploitation impact. Successful use of the SSRF yields a network pivot: the attacker can enumerate internal endpoints that are unreachable from the internet but reachable from the Lantronix device's network position (its SSH banner/response behavior confirms reachability). The attacker can also establish the device as an outbound SSH channel toward attacker-controlled infrastructure, potentially bypassing egress filtering or network segmentation that would normally block direct inbound/outbound access. Because the connection originates from a trusted management appliance, downstream systems and filtering controls may treat it as legitimate. The absence of integrity and availability impact means the appliance itself is not directly modified or taken down by this flaw; the value is in the resulting internal visibility and pivot.

No public PoC is available; the above attack chain is inferred from the SSRF vulnerability class and the rooturl behavior described in the NVD entry.

Impact Assessment

CVSS 3.1 base score 8.6 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

• AV:N — the WebSSH/WebTelnet listener is network-reachable; no physical or adjacent access required.
• AC:L — low attack complexity; the only requirement is crafting a web request with a modified rooturl value.
• PR:N — no authentication needed; unauthenticated attackers can trigger the flaw.
• UI:N — no victim interaction required.
• S:C — the vulnerable listener is exploited to affect resources beyond its own security scope (arbitrary reachable SSH endpoints).
• C:H / I:N / A:N — high confidentiality impact on systems reachable through the pivot; no direct integrity or availability impact on the appliance.

Business impact: Lantronix console managers are frequently deployed as out-of-band management appliances for servers, network gear, and industrial equipment. A successful SSRF turns the appliance into an internal reconnaissance and pivot point, undermining network segmentation that organizations rely on to isolate management planes. Because SLB882 remains affected in all firmware versions, organizations using that model have no vendor-provided fix path and face a persistent exposure. Nation-state and initial-access brokers prize edge management devices for exactly this kind of pivot; treat any exposed instance as a priority finding. CISA KEV status is NO, and no exploit-in-the-wild or threat-actor campaign has been attributed to CVE-2026-80149 in the provided data.

Detection Guidance

Sigma Rule

title: Lantronix WebSSH/WebTelnet SSRF via Manipulated rooturl Parameter
id: 7c4b1e9a-2f6d-4a51-9c33-8b0d5a6e2f14
status: experimental
description: Detects requests to the Lantronix WebSSH/WebTelnet (shellinaboxd) listener where the rooturl parameter is present and contains an IP literal or external host, indicating attempted SSRF (CVE-2026-80149).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-80149
author: threat-intel
logsource:
  category: webserver
detection:
  selection_rooturl:
    c-uri|contains: 'rooturl='
  filter_internal:
    c-uri|contains:
      - 'rooturl=localhost'
      - 'rooturl=127.0.0.1'
  selection_ip:
    c-uri|re: 'rooturl=(https?%3A%2F%2F)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
  condition: selection_rooturl and (selection_ip or not filter_internal)
falsepositives:
  - Legitimate administrative configuration of the terminal listener
level: high

YARA Rule

rule EXPL_CVE_2026_80149_Lantronix_Shellinaboxd_SSRF
{
    meta:
        description = "Detects HTTP requests abusing the rooturl parameter against Lantronix WebSSH/WebTelnet (shellinaboxd) SSRF (CVE-2026-80149)"
        author = "threat-intel"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-80149"
        date = "2026-01-01"
        severity = "high"

    strings:
        $rooturl = "rooturl=" ascii nocase wide
        $ssh_scheme = "rooturl=ssh" ascii nocase
        $http_scheme = "rooturl=http" ascii nocase
        $shellinabox = "shellinaboxd" ascii nocase

    condition:
        $rooturl and ($ssh_scheme or $http_scheme or $shellinabox)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-80149 Lantronix WebSSH/WebTelnet SSRF rooturl manipulation attempt"; flow:established,to_server; http.uri; content:"rooturl="; nocase; pcre:"/rooturl=(https?%3a%2f%2f|ssh%3a%2f%2f)?(\d{1,3}\.){3}\d{1,3}/Ri"; classtype:attempted-recon; reference:cve,2026-80149; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-80149; sid:202680149; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.transport == "tcp" and http.request.method == "GET"
     and url.query contains "rooturl="
     and url.path contains "shellinaboxd"]
  [network where network.transport == "tcp" and destination.port == 22]

Splunk SPL Query

index=web OR index=proxy
| eval raw = coalesce(uri, url, cs_uri_query)
| where like(raw, "%rooturl=%")
| eval rooturl_val = mvindex(split(raw, "rooturl="), 1)
| where match(rooturl_val, "(?i)^(https?%3A%2F%2F|ssh%3A%2F%2F)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, rooturl_val, host
| sort - count

Wazuh OSSEC Rule

<group name="web,ssrf,lantronix,">
  <rule id="202680149" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>rooturl=</url>
    <regex type="pcre2">rooturl=(?:https?%3A%2F%2F|ssh%3A%2F%2F)?(?:\d{1,3}\.){3}\d{1,3}</regex>
    <description>CVE-2026-80149: Lantronix WebSSH/WebTelnet SSRF attempt via rooturl parameter manipulation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>ssrf_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Before applying any fix, verify availability and integrity directly with Lantronix; the version thresholds below are taken from the NVD description and should be confirmed against the vendor's current advisory.

1. Immediate mitigations

   • Remove internet exposure of WebSSH/WebTelnet listeners on SLC8000, EMG8500/EMG7500, and SLB882. Place these interfaces behind a hardened VPN or a jump host with MFA.
   • Restrict inbound access to the management UI to known administrative source addresses with ACLs/firewalls; restrict outbound SSH (TCP/22) from these appliances to only explicitly required destinations to blunt the outbound-connection aspect of the flaw.
   • Monitor for abnormal outbound SSH connections originating from Lantronix appliances.
   • For SLB882, which remains affected in all firmware versions, treat network isolation as the only available control.

2. Patch / upgrade steps

   • SLC8000: upgrade to firmware v9.7.0.3 or later.
   • EMG8500 / EMG7500: upgrade to firmware v9.7.0.1 or later.
   • SLB882: no fixed firmware identified; engage Lantronix for guidance and rely on isolation.
   • After upgrade, re-verify that the rooturl parameter is validated server-side and that the listener no longer honors externally supplied host values for its own address resolution.

3. Long-term hardening

   • Inventory all Lantronix console managers and out-of-band management devices; enforce firmware currency through a maintenance schedule.
   • Segment management planes so that a compromised appliance cannot be used to reach production systems, and apply egress filtering to management VLANs.
   • Adopt centralized logging for web access to management interfaces and alert on anomalous rooturl values and unexpected SSH egress.
   • Reassess devices that have no available firmware fix (SLB882) for replacement or compensating network-layer controls.

References

• NVD — CVE-2026-80149: https://nvd.nist.gov/vuln/detail/CVE-2026-80149
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Lantronix product security / advisory portal (verify the fixed firmware versions for SLC8000, EMG8500/EMG7500, and SLB882 status)
• FIRST EPSS — not yet scored for CVE-2026-80149 (no value available)
• CISA KEV catalog — CVE-2026-80149 not listed (no known exploited status); no exploit-in-the-wild evidence or threat-actor campaign identified in the provided data.