CVE-2026-80151

Executive Summary

CVE-2026-80151 is a command injection vulnerability (CWE-78) in Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 device families that allows an authenticated attacker holding the "services" permission to execute arbitrary shell commands as root. The flaw resides in the set nfs download command, which passes unsanitized user input to a system() call, resulting in complete loss of confidentiality, integrity, and availability on the device and potentially on downstream serial-attached devices. With a CVSS v3.1 base score of 9.1 and no current patch evidence from tracked sources, organizations operating these console/terminal servers in out-of-band management paths face elevated risk.

Technical Analysis

The vulnerability is a classic OS command injection (CWE-78) arising from unsafe construction of a shell command string. Per the NVD description, the set nfs download command processes user-supplied input via an unsanitized parameter and forwards it to a system() call. Because system() invokes a shell interpreter, shell metacharacters (e.g., ;, |, &&, backticks, $()) embedded in the parameter are interpreted by the shell rather than treated as literal data, allowing arbitrary command execution.

Key technical characteristics:

• Attack surface: The terminal or CLI interface of the affected devices. Authentication is required, and the attacker must possess the "services" permission — a privileged role, but not necessarily full administrative/root rights, making this a privilege-escalation-to-root primitive once a services-level account is obtained.
• Execution context: Injection is performed through the set nfs download command. Because it is funneled to system(), any injected commands execute with the privileges of the process calling system() — described as root.
• Affected firmware:
  • SLC8000: before firmware v9.7.0.3
  • EMG8500 / EMG7500: before firmware v9.7.0.1
  • SLB882, SLCx-03, SLCx-02: all firmware versions
• Interfaces: These are serial console / terminal servers and out-of-band management appliances; the CLI/terminal interface is the vector described.
• CVSS rationale: AV:N (remotely reachable), AC:L (no special conditions), PR:H (requires services permission), UI:N (no user interaction), S:C (scope change — compromise of the device can affect connected/downstream serial-attached systems), C/I/A:H (full impact).

No CVE title, function signature, source file, or patch diff was provided. Where implementation specifics (exact parameter name, code path, internal libraries) are not stated in the description, this report intentionally avoids asserting them.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-80151. The attack chain below is inferred strictly from the NVD description and the command-injection vulnerability class; it does not invent function names or parameters beyond those explicitly cited.

1. Reconnaissance / target identification. The attacker identifies reachable Lantronix terminal/console servers (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) exposed via their CLI/terminal interface or web management reachable over the network. Fingerprinting may rely on the device banner, management UI title, or TLS certificate subject fields (e.g., "lantronix").

2. Access establishment. The attacker must already hold credentials with the "services" permission. This could stem from weak/default credentials, credential reuse, prior phishing, or lateral movement. No user interaction or additional conditions are required beyond a valid session.

3. Triggering the flaw. The attacker authenticates to the terminal or CLI interface and invokes the set nfs download command. The command accepts an input parameter that is passed unsanitized to a system() call. By embedding shell metacharacters in that parameter, the attacker causes the underlying shell to execute attacker-controlled commands instead of (or in addition to) the intended NFS download operation. Because the injection flows into system(), commands run with root privileges.

4. Payload / execution (vulnerability-class level). This is standard OS command injection: shell metacharacters injected into the vulnerable parameter cause arbitrary command execution. The report does not assert a specific payload syntax or parameter name beyond "the unsanitized parameter" as described.

5. Post-exploitation impact. Successful injection yields root-level command execution on the appliance. The CVSS scope-change (S:C) reflects that the device can serve as a pivot: complete loss of confidentiality, integrity, and availability on the device itself, with potential impact on downstream serial-attached devices that the management server controls. An attacker could read/modify device configuration, disrupt or hijack console sessions, alter out-of-band management paths, and use the appliance as a foothold into connected infrastructure.

Impact Assessment

• Confidentiality (C:H): Root access permits reading all device configuration, stored credentials, and any data traversing managed serial connections.
• Integrity (I:H): Root-level attacker can alter firmware, configuration, logging, and manipulate or spoof serial console sessions for attached devices.
• Availability (A:H): Root access enables disabling the appliance, dropping console sessions, or bricking management paths — catastrophic in an out-of-band management role.
• Scope (S:C): Compromise extends beyond the vulnerable component to downstream serial-attached devices controlled through the console server.
• Privileges required (PR:H): A "services" account is needed, but the payoff is full root, so a moderately privileged insider or a compromised low-tier account escalates to full device control.

Business impact: These devices often reside in out-of-band/data-center management networks. A full root compromise provides a resilient foothold on the management plane, enabling persistent access to critical infrastructure (network gear, servers, industrial endpoints reachable over serial). Blast radius includes not just the Lantronix appliance but every device its serial ports administer.

Detection Guidance

Detection focuses on CLI/terminal command usage of set nfs download with shell metacharacters, and on post-exploitation activity (unexpected root processes, shell spawns). Because no public exploit signature exists, detections are behavioral.

Sigma Rule

title: Lantronix Console Server Command Injection via 'set nfs download'
id: 3f9c2b7e-8a41-4d6e-91b2-lantronix-cve-2026-80151
status: experimental
description: Detects command injection attempts against Lantronix CLI 'set nfs download' command by matching shell metacharacters in the parameter (CVE-2026-80151).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-80151
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    CommandLine|contains:
      - 'set nfs download'
  selection_metachar:
    CommandLine|contains:
      - ';'
      - '|'
      - '&&'
      - '||'
      - '`'
      - '$('
      - '>'
      - '$(('
  condition: selection_cmd and selection_metachar
fields:
  - CommandLine
  - User
  - ParentImage
falsepositives:
  - Legitimate administrative use of set nfs download with unusual characters (rare)
level: high
tags:
  - attack.t1190
  - cve.2026.80151

YARA Rule

rule CVE_2026_80151_Lantronix_CmdInjection
{
    meta:
        description = "Detects command injection strings targeting Lantronix 'set nfs download' (CVE-2026-80151) in logs or config artifacts"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-80151"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cli = "set nfs download" ascii wide nocase
        $meta1 = ";" ascii
        $meta2 = "&&" ascii
        $meta3 = "$(" ascii
        $meta4 = "`" ascii

    condition:
        $cli and any of ($meta*)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-80151 Lantronix Command Injection Attempt via 'set nfs download'"; flow:to_server,established; content:"set nfs download"; nocase; content:";"; within:128; reference:cve,2026-80151; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-80151; classtype:attempted-admin; sid:1002151; rev:1;)

Elastic Detection

process where process.parent.name in ("in.a", "cli", "ltrxsvcd", "telnetd")
and process.command_line : "set nfs download"
and (
  process.command_line : "*;*" or
  process.command_line : "*|*" or
  process.command_line : "*&&*" or
  process.command_line : "*$(*" or
  process.command_line : "*`*"
)

Splunk SPL Query

index=main (sourcetype=syslog OR sourcetype=linux_secure OR sourcetype=cli_audit)
("set nfs download")
(";" OR "&&" OR "$(" OR "|" OR "`")
| stats count min(_time) as first_seen max(_time) as last_seen values(host) as hosts by user, process
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="lantronix,cve-2026-80151,">
  <rule id="100951" level="12">
    <decoded_as>syslog</decoded_as>
    <match>set nfs download</match>
    <regex>set nfs download.*[;|`]|set nfs download.*\&\&|set nfs download.*\$\{</regex>
    <description>CVE-2026-80151: Possible Lantronix command injection via 'set nfs download' with shell metacharacters</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>command_injection,cve_2026_80151,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list was provided beyond the NVD description. Note that NVD references version thresholds for some models (SLC8000 ≥ v9.7.0.3, EMG8500/EMG7500 ≥ v9.7.0.1), but no patch source was confirmed as available; SLB882/SLCx-03/SLCx-02 remain indicated as affected in all firmware versions.

1. Immediate mitigations

   • Restrict network exposure of the CLI/terminal and management interfaces to trusted management VLANs / jump hosts only; block internet and general-user access.
   • Enforce least privilege: audit and revoke the "services" permission from accounts that do not strictly require it. Rotate credentials and remove default or shared accounts.
   • Apply strict segmentation to out-of-band management networks; monitor and alert on CLI access.
   • Where feasible, place these appliances behind a management VPN/bastion with MFA and command auditing.

2. Patch / upgrade steps

   • Contact Lantronix support for the latest firmware and confirmed fixed builds for each model (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02).
   • For SLC8000 and EMG8500/EMG7500, confirm whether the firmware versions cited as thresholds in NVD (v9.7.0.3 and v9.7.0.1 respectively) remediate the injection, and validate independently before relying on them.
   • For SLB882/SLCx-03/SLCx-02, seek vendor guidance since no fixed version is indicated; apply compensating controls if no fix is available.

3. Long-term hardening

   • Enforce input validation / parameterized handling around any CLI command that reaches an OS shell; ideally eliminate system()-style shell invocation for user-supplied input.
   • Deploy centralized logging of CLI/terminal commands and alert on shell metacharacters in parameters.
   • Maintain a hardware/firmware inventory with vulnerability tracking; monitor NVD/CISA advisories for Lantronix.
   • Implement defense-in-depth: out-of-band management isolation, MFA, and role-based access control.

References

• NVD — CVE-2026-80151: https://nvd.nist.gov/vuln/detail/CVE-2026-80151
• CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Lantronix Product Security / Support (consult for firmware advisories): https://www.lantronix.com/
• CISA Known Exploited Vulnerabilities Catalog (not currently listed; verify for updates): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public threat-actor campaign or exploit-in-the-wild evidence was identified for CVE-2026-80151 based on the data provided; CISA KEV status is NO, and no PoC/exploit code is publicly available.