CVE-2026-80150

Executive Summary

CVE-2026-80150 is an unauthenticated server-side request forgery (SSRF) vulnerability in Lantronix console management devices (SLC8000, EMG8500, EMG7500, and SLB882) that affects the WebSSH/WebTelnet listener component. By manipulating the rooturl parameter, an unauthenticated attacker can force the device to establish Telnet connections to arbitrary, attacker-controlled endpoints, enabling internal network enumeration and communication with otherwise inaccessible hosts. With a CVSS score of 7.5 (High) and no patch available for the SLB882 product line, organizations exposing these devices to untrusted networks face significant risk of internal network reconnaissance and lateral movement enablement.

Technical Analysis

The vulnerability resides in the WebSSH/WebTelnet listener functionality of the affected Lantronix devices. These devices run a customized version of shellinaboxd, a web-based terminal emulator that provides browser-accessible Telnet/SSH sessions to managed console ports.

The core mechanism is a parameter injection flaw: the custom shellinaboxd implementation uses the rooturl parameter supplied via the web connection to determine its own IP address. This design assumes the rooturl value reflects the legitimate server address. An attacker can supply an arbitrary value in the rooturl parameter, causing the device to redirect the Telnet terminal connection to an attacker-specified host or IP address instead of the intended local or trusted endpoint.

From a vulnerability-class perspective, this is a classic CWE-918 (Server-Side Request Forgery). The device acts as a proxy: instead of connecting to its own internal console endpoint, it initiates an outbound Telnet connection to whatever rooturl specifies. Because the shellinaboxd process runs within the device's network context — often on management VLANs with access to internal segments — the attacker leverages the device's network position to reach destinations that would otherwise be unreachable from the attacker's vantage point.

The attack requires no authentication (PR:N in the CVSS vector), no user interaction (UI:N), and is network-reachable (AV:N). The complexity is low (AC:L) because the parameter manipulation is straightforward. The confidentiality impact is High (C:H) because the SSRF enables internal network enumeration and potential data exfiltration via Telnet-based interaction with internal services. Integrity and availability impacts are rated None (I:N/A:N) because the primary attack vector is information disclosure and network mapping rather than data modification or service disruption.

The affected firmware versions are:

• Lantronix SLC8000: all versions before firmware v9.7.0.3
• Lantronix EMG8500: all versions before firmware v9.7.0.1
• Lantronix EMG7500: all versions before firmware v9.7.0.1
• Lantronix SLB882: all firmware versions (no fix identified in tracked sources)

Exploitation Scenarios

No public proof-of-concept (PoC) is available for CVE-2026-80150. The following attack chain is inferred from the vulnerability class (SSRF) and the technical details provided in the NVD description.

1. Reconnaissance / Target Identification An attacker identifies internet-exposed or internally reachable Lantronix SLC8000, EMG8500, EMG7500, or SLB882 devices. These are typically discoverable via web interface fingerprints (e.g., shellinaboxd-served pages, device login portals). The WebSSH/WebTelnet listener must be accessible. Shodan or similar internet-scanning services can locate exposed instances using product-specific HTTP titles or HTML content.

2. Triggering the Specific Flaw The attacker sends a crafted HTTP request to the WebSSH/WebTelnet listener endpoint, injecting a malicious value into the rooturl parameter. This parameter is normally used by shellinaboxd to determine the server's own IP address for establishing the terminal connection. By supplying an attacker-controlled IP or hostname in rooturl, the attacker redirects the Telnet terminal connection target.

3. Payload/Execution Method (Vulnerability-Class Level) At the vulnerability-class level, this is an SSRF: the attacker-controlled input (rooturl) is used by the server to construct a connection destination without proper validation. The device's shellinaboxd process initiates a Telnet connection to the attacker-specified endpoint. No authentication is required, so the request can be sent directly from an unauthenticated context. The payload is the manipulated rooturl value pointing to an internal IP address, hostname, or attacker-controlled listener.

4. Post-Exploitation Impact Successful exploitation allows the attacker to:

• Enumerate internal network endpoints by observing connection success/failure or banner responses from the device's vantage point.
• Communicate with internal hosts or services via Telnet that are not directly reachable from the attacker's external position.
• Potentially interact with internal Telnet services (e.g., management interfaces, legacy systems) using the compromised device as a proxy.

The confidentiality impact is High. The attacker does not gain direct code execution on the device, but the SSRF enables a pivot into the internal network and information gathering that would otherwise be blocked by network segmentation.

Impact Assessment

The CVSS 3.1 base score is 7.5 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The subscores indicate:

• Attack Vector (AV:N): Exploitable remotely over the network.
• Attack Complexity (AC:L): No special conditions or race conditions required.
• Privileges Required (PR:N): No authentication needed — the WebSSH/WebTelnet listener accepts unauthenticated requests.
• User Interaction (UI:N): No victim action required.
• Scope (S:U): The impact is confined to the vulnerable component's security authority.
• Confidentiality (C:H): High — internal network enumeration and communication with otherwise inaccessible endpoints.
• Integrity (I:N): No direct data modification demonstrated.
• Availability (A:N): No denial-of-service impact demonstrated.

Business Impact: Lantronix devices are commonly deployed in operational technology (OT), industrial control systems (ICS), data centers, and remote infrastructure management. These devices often sit on management networks with privileged access to critical systems. An SSRF that enables internal Telnet connectivity can expose OT/ICS management interfaces, legacy Telnet services, and internal administrative endpoints. The blast radius depends on the device's network position — a single compromised device on a management VLAN can serve as a reconnaissance pivot across that segment.

Affected Systems: All Lantronix SLC8000 (before v9.7.0.3), EMG8500/EMG7500 (before v9.7.0.1), and SLB882 (all versions). The SLB882 is particularly concerning because no patch has been identified in tracked sources, meaning all deployed units remain vulnerable.

Detection Guidance

Sigma Rule

title: Lantronix shellinaboxd SSRF via rooturl Parameter
id: 8f3a2c1e-9b4d-4a7f-b2e1-1c3d5e7f9a0b
status: experimental
description: Detects exploitation attempts of CVE-2026-80150 targeting Lantronix devices via the rooturl parameter in WebSSH/WebTelnet listener requests.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-80150
author: valtersit.com
date: 2026/05/18
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_uri:
    cs-uri-query|contains:
      - 'rooturl='
  selection_target:
    cs-uri-query|contains:
      - 'rooturl=http'
      - 'rooturl=//'
      - 'rooturl=telnet'
  condition: selection_method and selection_uri and selection_target
falsepositives:
  - Legitimate administrative use of the rooturl parameter (rare)
level: high
tags:
  - attack.t1190
  - cve.2026.80150

YARA Rule

rule CVE_2026_80150_Lantronix_SSRF_Rooturl
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-80150 in Lantronix device HTTP traffic"
        author = "valtersit.com"
        date = "2026-05-18"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-80150"
        severity = "high"

    strings:
        $rooturl = "rooturl=" ascii nocase
        $shellinabox = "shellinabox" ascii nocase
        $webssh = "webssh" ascii nocase
        $webtelnet = "webtelnet" ascii nocase
        $telnet = "telnet://" ascii nocase
        $http_prefix = "rooturl=http" ascii nocase

    condition:
        any of ($shellinabox, $webssh, $webtelnet) and $rooturl and (any of ($telnet, $http_prefix))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-80150 Lantronix shellinaboxd SSRF via rooturl parameter"; flow:to_server,established; http.uri.raw; content:"rooturl="; nocase; pcre:"/rooturl=(http|ftp|telnet|\/\/|[0-9]{1,3}\.[0-9]{1,3})/i"; threshold:type limit, track by_src, count 5, seconds 60; reference:cve,2026-80150; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-80150; classtype:web-application-attack; sid:202680150; rev:1;)

Elastic Detection

network where
  network.protocol == "http" and
  url.path != null and
  url.query contains "rooturl=" and
  (
    url.query contains "rooturl=http" or
    url.query contains "rooturl=//" or
    url.query contains "rooturl=telnet" or
    url.query regex~ "rooturl=[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
  ) and
  http.request.method in ("GET", "POST")

Splunk SPL Query

index=web OR index=proxy OR index=network
(sourcetype=access_combined OR sourcetype=stream:http OR sourcetype=pan:traffic)
| search uri="*rooturl=*"
| eval suspicious=case(
    match(uri, "rooturl=https?://"), "SSRF-HTTP",
    match(uri, "rooturl=telnet://"), "SSRF-Telnet",
    match(uri, "rooturl=//"), "SSRF-ProtocolRelative",
    match(uri, "rooturl=\d+\.\d+\.\d+\.\d+"), "SSRF-IP-Direct",
    true(), "Benign")
| where suspicious != "Benign"
| stats count min(_time) as firstSeen max(_time) as lastSeen
    values(suspicious) as attack_types
    values(uri) as urls
    by src_ip, dest_ip, http_user_agent
| convert ctime(firstSeen) ctime(lastSeen)
| sort - count

Wazuh OSSEC Rule

<group name="web,ssrf,cve-2026-80150,">
  <rule id="2026801" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>rooturl=</url>
    <description>CVE-2026-80150: Lantronix shellinaboxd SSRF exploitation attempt via rooturl parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_80150,ssrf,</group>
  </rule>

  <rule id="2026802" level="14">
    <if_sid>2026801</if_sid>
    <regex>rooturl=(https?|telnet|//)</regex>
    <description>CVE-2026-80150: Confirmed SSRF injection with redirectable protocol in rooturl parameter</description>
    <group>cve_2026_80150,ssrf,attack,</group>
  </rule>

  <rule id="2026803" level="14">
    <if_sid>2026801</if_sid>
    <regex>rooturl=\d+\.\d+\.\d+\.\d+</regex>
    <description>CVE-2026-80150: SSRF injection targeting internal IP address via rooturl parameter</description>
    <group>cve_2026_80150,ssrf,internal_recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1. Immediate Mitigations:

• Restrict network access to the WebSSH/WebTelnet listener on all affected Lantronix devices. Ensure these interfaces are not exposed to the internet and are reachable only from trusted administrative networks.
• Disable the WebSSH/WebTelnet listener if it is not operationally required. If required, enforce strict firewall rules limiting access to known management IP ranges.
• Segment affected devices onto dedicated management VLANs with egress filtering that prevents outbound Telnet connections to arbitrary internal IP addresses.
• Monitor for anomalous outbound Telnet traffic originating from Lantronix device IPs — this is the primary observable indicator of exploitation.
• Apply network-level egress ACLs on the devices or their upstream switches to restrict outbound connections to only known, necessary management endpoints.

2. Patch/Upgrade Steps:

• Lantronix SLC8000: Upgrade to firmware v9.7.0.3 or later (fix identified).
• Lantronix EMG8500/EMG7500: Upgrade to firmware v9.7.0.1 or later (fix identified).
• Lantronix SLB882: No fix identified in tracked sources — all firmware versions remain vulnerable. Deploy compensating controls (network segmentation, access restriction, egress filtering) and contact Lantronix for vendor guidance on remediation timelines.
• Verify firmware integrity after upgrade and confirm the WebSSH/WebTelnet listener behavior no longer honors external rooturl redirection.

3. Long-Term Hardening:

• Adopt a zero-trust network architecture for management interfaces; never expose console servers or terminal emulation services to untrusted networks.
• Implement continuous monitoring for SSRF-class attacks across all web-exposed infrastructure components.
• Enforce strict input validation at the application layer for URL-parameter-derived connection destinations as a development standard.
• Maintain an inventory of all Lantronix and similar out-of-band management devices with firmware version tracking and vulnerability subscription alerts.
• Conduct regular network segmentation audits to ensure management devices cannot reach production or sensitive internal segments without explicit policy.

References

1. National Vulnerability Database — CVE-2026-80150: https://nvd.nist.gov/vuln/detail/CVE-2026-80150
2. MITRE CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
3. Lantronix Product Security Advisories: https://www.lantronix.com/support/security-advisories/
4. FIRST.org EPSS — CVE-2026-80150 (not yet scored): https://api.first.org/data/v1/epss?cve=CVE-2026-80150
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-80150 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor / Exploit-in-the-Wild Status: No public PoC, exploit code, or Nuclei template is available for CVE-2026-80150. The CVE is not listed in CISA KEV. No threat actor campaigns have been publicly attributed to this vulnerability at the time of writing. EPSS has not yet scored this CVE.