CVE-2026-80152

Executive Summary

CVE-2026-80152 is a critical (CVSS 9.1) command injection vulnerability in Lantronix serial/console management appliances — SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 — caused by unsanitized user input being passed to a system() call via the set script schedule command. An authenticated attacker holding the "services" permission can inject arbitrary shell commands that execute as root, resulting in total loss of confidentiality, integrity, and availability on the affected device. Because these appliances are used to manage downstream serial-attached infrastructure (routers, switches, servers, OT devices), successful exploitation can extend the blast radius to connected equipment.

Technical Analysis

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command, i.e. OS command injection). According to the NVD description, the flaw is reachable through the set script schedule command, which passes unsanitized user input into a system() call.

Core mechanism:

• A CLI/terminal-facing command handler for set script schedule accepts an attacker-controlled parameter and forwards it to the C library system() function without sanitization or shell-metacharacter escaping.
• Because system() invokes the operating system's shell (/bin/sh and equivalents), any shell metacharacters embedded in the parameter (command separators, pipes, substitution constructs, redirection) are interpreted by the shell rather than treated as literal data.
• The resulting command executes with the privileges of the process invoking system() — the NVD description states the commands execute as root.

Attack surface and access requirements:

• Vector: Network (AV:N). The appliance CLI is reachable over the network (terminal/CLI interface).
• Privileges Required: High (PR:H). The attacker must already be authenticated and hold the "services" permission.
• User Interaction: None (UI:N) — no victim action is required beyond the attacker's own authenticated session.
• Scope: Changed (S:C) — impact is not confined to the vulnerable component, consistent with root-level compromise and potential impact to downstream serial-attached devices.

The combination of an authenticated-but-low-tier "services" role and root-level execution means this is a privilege-escalation-plus-command-injection chain: an operator-level capability is elevated to full device control. The NVD description does not disclose the exact parameter name or the CLI invocation syntax, so no such specifics are asserted here.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-80152. The attack chain below is inferred at the vulnerability-class level from the NVD description and must not be treated as a verified exploit procedure.

1. Reconnaissance / target identification Attackers identify internet- or network-exposed Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, or SLCx-02 appliances via banner/version fingerprinting of the web management or CLI login interface. Note that SLB882, SLCx-03, and SLCx-02 are described as affected across all firmware versions, so version-based triage will not distinguish a patched device for those models.

2. Authentication and precondition The attacker must authenticate to the terminal or CLI interface with an account that holds the "services" permission. This is a precondition, not a bypass — no authentication bypass is described in the CVE data. Credential reuse, default credentials, or lateral movement from a compromised management host are the plausible routes to this precondition.

3. Triggering the flaw class Through the authenticated CLI/terminal session, the attacker issues the set script schedule command and supplies malicious input in the unsanitized parameter. The command injection class means the injected content is not treated as data but is interpreted by the shell once the handler builds and executes the underlying system() call.

4. Payload / execution Because the parameter flows into a shell invocation, standard OS command injection payload structures are applicable (command chaining, piping, or command substitution using the target shell's metacharacters). Execution occurs as root, per the NVD description. The report deliberately does not specify a concrete parameter name or payload string, as these are not disclosed in the available data.

5. Post-exploitation impact Root code execution on the appliance yields complete loss of confidentiality, integrity, and availability (C:H/I:H/A:H). Practical consequences include reading/writing device configuration and secrets, persisting on the appliance, disabling management/logging, and — critically — pivoting to downstream serial-attached devices that the console/terminal server manages. The S:C scope metric reflects this cross-boundary impact.

Impact Assessment

• Base score: 9.1 (Critical), CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
• Confidentiality (C:H): Root access exposes appliance configuration, credentials, and any data traversing the managed serial links.
• Integrity (I:H): An attacker can alter scripts, schedules, firmware-adjacent configuration, and device state.
• Availability (A:H): Root compromise permits disabling services or destabilizing the appliance, impacting any device that depends on it for console access.
• Scope (S:C): Impact extends beyond the vulnerable component to downstream serial-attached devices — a materially higher risk than a self-contained appliance compromise.
• Attack complexity is Low (AC:L) once credentials are held; the effective barrier is the High privilege requirement (PR:H) combined with network reachability.
• Blast radius: Organizations using these Lantronix models as out-of-band management or serial console gateways for network, server, or OT/ICS assets face a high-value pivot point. A single compromised appliance can subvert the management plane for many connected endpoints.
• Exploitation likelihood: EPSS is not yet scored by FIRST.org, there is no CISA KEV listing, and no public exploit exists. Current exploitation is assessed as targeted rather than mass-exploited, but impact severity is maximal if reached.

Detection Guidance

Sigma Rule

title: Lantronix SLC/EMG/SLB Command Injection via set script schedule (CVE-2026-80152)
id: 7c2f1a94-1b6e-4d2a-9f3c-0a5e8b1d4c77
status: experimental
description: Detects command injection attempts against Lantronix console/terminal servers via shell metacharacters in CLI input
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-80152
author: SOC Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/sh'
      - '/bash'
      - '/bin/sh'
  selection_flags:
    CommandLine|contains:
      - ';'
      - '&&'
      - '||'
      - '`'
      - '$('
      - 'set script schedule'
  condition: selection_parent and selection_flags
falsepositives:
  - Legitimate administrative scripts scheduled by authorized personnel
level: high

YARA Rule

rule CVE_2026_80152_Lantronix_CmdInjection
{
    meta:
        description = "Detects command injection payloads targeting Lantronix set script schedule (CVE-2026-80152)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-80152"
        author = "SOC Threat Intelligence"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $cmd = "set script schedule" nocase
        $m1  = ";" ascii
        $m2  = "&&" ascii
        $m3  = "||" ascii
        $m4  = "$(" ascii
        $m5  = "`" ascii
        $m6  = "curl " ascii nocase
        $m7  = "wget " ascii nocase
        $m8  = "/bin/sh" ascii

    condition:
        $cmd and (any of ($m*) )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-80152 Lantronix set script schedule Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"script"; nocase; http.client_body; content:"set script schedule"; nocase; content:";"; distance:0; pcre:"/(;|\|\||&&|\$\(|`)/"; threshold:type both, track by_src, count 5, seconds 60; classtype:web-application-attack; reference:cve,2026-80152; sid:202680152; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("sh", "bash") and
  process.args : ("*set script schedule*", "*$( *", "*`*", "*; *")

Splunk SPL Query

index=* (sourcetype=lantronix:* OR sourcetype=syslog OR source=*slc* OR source=*emg*)
| search ("set script schedule" AND (";" OR "&&" OR "||" OR "$(" OR "`" OR "curl" OR "wget"))
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips by host, user, command
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="lantronix,cve-2026-80152,">
  <rule id="100652" level="15">
    <decoded_as>syslog</decoded_as>
    <match>set script schedule</match>
    <regex>(;|&&|\|\||\$\(|`)</regex>
    <description>CVE-2026-80152: Lantronix command injection attempt detected via set script schedule</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note, however, that the NVD description references fixed firmware versions for some models; validate availability directly with the vendor before relying on them.

1. Immediate mitigations

• Restrict network access to the appliance CLI/terminal and web management interfaces. Place them behind a management VLAN, jump host, or VPN; do not expose to untrusted networks.
• Enforce least privilege: audit all accounts holding the "services" permission and remove or downgrade any that do not strictly require it. Rotate credentials for these accounts.
• Enable and forward authentication and CLI/command logging to the SIEM, and alert on shell metacharacters in scheduled-script or CLI inputs (see Detection Guidance).
• Where feasible, enforce MFA at the management layer or a compensating access-control gateway.

2. Patch/upgrade steps

• SLC8000: upgrade to firmware v9.7.0.3 or later.
• EMG8500 / EMG7500: upgrade to firmware v9.7.0.1 or later.
• SLB882, SLCx-03, SLCx-02: no fixed version is documented; these models are affected across all firmware versions. Treat them as unfixed and isolate them until the vendor provides guidance.
• Before upgrading, export and preserve configuration, and verify remediation by confirming the deployed firmware build against the vendor's advisory.

3. Long-term hardening

• Maintain an inventory of all Lantronix console/terminal servers and their firmware; these devices are frequently overlooked in vulnerability management.
• Segment out-of-band management networks from production traffic and monitor the serial/console plane for anomalous commands.
• Apply a vulnerability management cadence that includes embedded and OT-adjacent appliances, and monitor vendor advisories for SLB882/SLCx-03/SLCx-02 remediation.
• Institute change control for scheduled-script functionality so that any addition or modification is logged and reviewed.

References

1. NVD — CVE-2026-80152: https://nvd.nist.gov/vuln/detail/CVE-2026-80152
2. CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
3. MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
4. FIRST EPSS — CVE-2026-80152: https://api.first.org/data/v1/epss?cve=CVE-2026-80152 (not yet scored)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-80152 not listed)

Threat actor note: No CISA KEV listing, no public PoC, and no reported exploit-in-the-wild evidence were identified in the tracked sources for this CVE. Attribution to any specific threat actor or campaign cannot be supported by the available data; exploitation at scale or by named actors should not be assumed.