CVE-2026-80155

Executive Summary

CVE-2026-80155 is a critical authentication bypass vulnerability in the web management portal of multiple Lantronix serial console and device management appliances. An unauthenticated remote attacker can exploit a path traversal flaw in the session cookie validation logic to bypass authentication, read sensitive configuration files, upload arbitrary files, and ultimately achieve remote code execution. The vulnerability affects Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 devices, with complete loss of confidentiality, integrity, and availability possible on the appliance and potentially on connected downstream serial devices.

Technical Analysis

The vulnerability resides in the web management portal upload endpoint of affected Lantronix devices. According to the NVD description, the web configuration server constructs the session cookie file path using the snprintf function with a fixed-size buffer. When an attacker supplies a cookie value of a specific length, the resulting path is truncated at a required delimiter. This truncation allows the attacker to leverage path traversal to redirect the authentication validation check to an arbitrary on-disk file — for example, the local user database — thereby bypassing all session validation checks.

The root cause is a combination of two weaknesses: improper handling of user-controlled input in a fixed-size buffer (snprintf truncation) and insufficient validation of path components. Because the session cookie path is constructed without proper sanitization, an attacker can craft a cookie that, after truncation, points to a file on the device filesystem that the authentication logic treats as a valid session store. This effectively nullifies authentication requirements for the upload endpoint.

The upload endpoint itself accepts files and writes them to the filesystem. According to the NVD description, attackers can "upload files to arbitrary filesystem locations." This arbitrary file write capability, combined with the authentication bypass, directly enables remote code execution when the uploaded file is placed in a location that is executed or interpreted by the device.

The affected devices are serial console managers and terminal servers widely used in industrial, healthcare, and enterprise environments to manage network infrastructure, servers, and OT/ICS equipment over serial connections. The web management portal is the primary administrative interface, typically exposed on ports 80 and 443.

The CWE classification is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., Path Traversal), which aligns with the described attack mechanism. The CVSS vector indicates network exploitable, low complexity, no privileges required, no user interaction, with scope change because the vulnerable component impacts resources beyond its security scope (downstream serial-connected devices).

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-80155. The following attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance and target identification: An attacker scans for internet-facing Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, or SLCx-02 devices. These are often exposed via Shodan or similar services using dorks targeting the web management portal. The attacker verifies the presence of the vulnerable web interface and the upload endpoint.

2. Triggering the authentication bypass: The attacker crafts a session cookie with a value of a specific length. When submitted to the web server, the server constructs the session file path using snprintf into a fixed-size buffer. The oversized cookie value causes the path to be truncated at a delimiter character, and the attacker embeds path traversal sequences so that the resulting truncated path points to a known file on disk — such as the local user database file. Because the authentication logic reads and validates against this file, the attacker's request is treated as authenticated without valid credentials.

3. Arbitrary file read and upload: With authentication bypassed, the attacker accesses the upload endpoint. They can first read sensitive configuration files (including stored credentials, network configurations, and certificate material) by leveraging the same path traversal or by using the upload endpoint's read capability if present. The attacker then uploads a malicious file to an arbitrary filesystem location. Because the vulnerability allows writing to any path writable by the web server process, the attacker may target a directory from which scripts or binaries are executed, or overwrite configuration files that are later processed.

4. Remote code execution and post-exploitation impact: By uploading a crafted file to an appropriate location, the attacker achieves remote code execution with the privileges of the web server process. This allows full control of the appliance. The attacker can then pivot to downstream serial-connected devices — such as routers, switches, servers, or OT equipment — by using the appliance's serial connections, modifying configurations, or abusing trust relationships. The CVSS scope change (S:C) reflects this potential impact beyond the vulnerable appliance itself.

No specific function names, URL paths, or parameter names beyond those in the NVD description are provided, so the attack chain remains at the vulnerability-class level.

Impact Assessment

The CVSS v3.1 base score is 10.0 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This indicates:

• Attack Vector (Network): Exploitable remotely over the network.
• Attack Complexity (Low): No special conditions beyond crafting a cookie of a specific length.
• Privileges Required (None): No authentication is needed.
• User Interaction (None): No victim action required.
• Scope (Changed): The vulnerable web server impacts resources beyond its security scope, including downstream serial-connected devices.
• Confidentiality, Integrity, Availability (High): Complete loss of each.

Business impact includes total compromise of the affected appliance, unauthorized access to sensitive configuration data, disruption or manipulation of serial-managed infrastructure, and potential lateral movement into OT/ICS networks. Affected systems include Lantronix SLC8000 (firmware before v9.7.0.5), EMG8500 and EMG7500 (firmware before v9.7.0.1), and all firmware versions of SLB882, SLCx-03, and SLCx-02. Devices with no available patch remain vulnerable indefinitely. The blast radius extends to any network segment reachable from the compromised appliance, particularly serial-connected devices used in critical infrastructure, manufacturing, and healthcare.

Detection Guidance

Sigma Rule

title: Lantronix Web Portal Authentication Bypass via Cookie Path Traversal
id: 8f4c2e1a-7b3d-4f6e-9a2c-1d5e8f7b3c4a
status: experimental
description: Detects attempts to exploit CVE-2026-80155 by supplying an oversized or path traversal cookie to the Lantronix web management portal.
author: ValtersIT Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: lantronix
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  selection_uri:
    cs-uri-stem|contains:
      - '/upload'
      - '/config'
      - '/management'
  selection_cookie:
    cs-cookie|contains:
      - '../'
      - '..%2f'
      - '..%5c'
  selection_length:
    cs-cookie|re: '^.{200,}'
  condition: selection_method and selection_uri and (selection_cookie or selection_length)
fields:
  - c-ip
  - cs-uri-stem
  - cs-cookie
falsepositives:
  - Legitimate long session cookies from other applications
level: high

YARA Rule

rule CVE_2026_80155_Lantronix_PathTraversal
{
    meta:
        description = "Detects path traversal attempts targeting Lantronix web management portal authentication bypass"
        author = "ValtersIT Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-80155"
        severity = "critical"

    strings:
        $traversal1 = "../" ascii wide nocase
        $traversal2 = "..\\" ascii wide nocase
        $traversal3 = "..%2f" ascii wide nocase
        $traversal4 = "..%5c" ascii wide nocase
        $upload = "/upload" ascii wide nocase
        $config = "/config" ascii wide nocase
        $cookie = "Cookie:" ascii wide nocase

    condition:
        uint16(0) == 0x4854 and
        (any of ($traversal*)) and
        (any of ($upload, $config)) and
        $cookie
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-80155 Lantronix Authentication Bypass Attempt via Path Traversal Cookie"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"upload"; http.header; content:"Cookie|3a|"; pcre:"/\.\.(\/|\\|%2f|%5c)/i"; threshold:type both, track by_src, count 5, seconds 60; reference:cve,2026-80155; classtype:attempted-admin; sid:202680155; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "POST" and url.path contains "upload" and http.request.headers.cookie contains "../"]
  [network where http.request.method == "PUT" or http.request.method == "POST"]

Splunk SPL Query

index=web sourcetype=access_combined
| search (method=POST OR method=PUT) (uri_path="/upload*" OR uri_path="*upload*" OR uri_path="*config*")
| rex field=cookie "(?<traversal>\.\.(/|\\|%2f|%5c))"
| where isnotnull(traversal) OR len(cookie) > 200
| stats count min(_time) as first_seen max(_time) as last_seen by clientip, uri_path, cookie
| where count > 0
| sort -count

Wazuh OSSEC Rule

<group name="web,laravel,">
  <rule id="202680155" level="12">
    <if_sid>31100,31101,31103,31104</if_sid>
    <field name="url">upload|config</field>
    <field name="cookie">\.\.|\.\.%2f|\.\.%5c</field>
    <description>CVE-2026-80155: Lantronix authentication bypass attempt via path traversal in session cookie from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_80155,authentication_bypass,path_traversal,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No official patch exists for all affected models. Firmware fixes exist for Lantronix SLC8000 (v9.7.0.5) and EMG8500/EMG7500 (v9.7.0.1), but no patch is available for SLB882, SLCx-03, or SLCx-02.

1. Immediate mitigations:

   • Isolate affected devices from untrusted networks. Place the web management portal behind a firewall and restrict access to authorized management IPs only.
   • Disable the web management portal (HTTP/HTTPS) if not required for operations. Use serial console or SSH management where possible.
   • Implement network segmentation to prevent lateral movement from a compromised appliance to downstream serial-connected devices.
   • Monitor web server logs for oversized cookies, path traversal sequences (../, ..%2f, ..%5c), and unusual upload requests.
   • Change all credentials and inspect configuration files for signs of tampering if compromise is suspected.

2. Patch/upgrade steps:

   • For SLC8000: upgrade to firmware v9.7.0.5 or later.
   • For EMG8500/EMG7500: upgrade to firmware v9.7.0.1 or later.
   • For SLB882, SLCx-03, and SLCx-02: no vendor patch is available; consider device replacement or apply compensating controls.
   • Verify firmware integrity after upgrade and reset all administrative credentials.

3. Long-term hardening:

   • Enforce strong network access control and multi-factor authentication for management interfaces where supported.
   • Regularly audit and update firmware for all Lantronix devices.
   • Implement continuous monitoring for path traversal and authentication bypass attempts.
   • Adopt a zero-trust architecture for OT/ICS environments, ensuring serial-connected devices are not implicitly trusted by management appliances.

References

1. NVD — CVE-2026-80155: https://nvd.nist.gov/vuln/detail/CVE-2026-80155
2. Lantronix Security Advisories: https://www.lantronix.com/security-advisories/
3. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-80155 not listed as of this report)