CVE-2026-80156

Executive Summary

CVE-2026-80156 is an authenticated path traversal vulnerability (CWE-22) in the web management portal upload endpoint of multiple Lantronix console server / serial management products, including SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02. A flaw in filename validation — backslash characters are stripped, but forward slashes are not subsequently checked when a backslash is detected — allows a logged-in attacker to write arbitrary files to any writable path on the device filesystem, resulting in remote code execution and full loss of confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.1 (Critical), with a scope change (S:C) reflecting potential downstream impact on serial-connected devices.

Technical Analysis

The vulnerability resides in the upload endpoint of the web management portal common to the affected Lantronix product families. The core defect is a classic incomplete input-sanitization / path-traversal condition (CWE-22):

• The filename supplied during an upload is inspected for backslash (\) characters, which are stripped.
• When a backslash is detected, the code appears to branch into a sanitization path that does not subsequently validate for forward slashes (/).
• By crafting a filename that contains both a backslash and forward slashes (e.g., a construct that satisfies the "backslash detected" branch while still carrying path-separator forward slashes), an attacker bypasses the traversal guard.
• The manipulated filename is then used to construct the destination path for the write operation, allowing the uploaded content to be written outside the intended upload directory to any location the web service's process can write to.

Because the upload primitive accepts arbitrary file content ("write arbitrary data to any location"), the practical consequence is arbitrary file write with attacker-controlled bytes. On embedded Linux-based management appliances, writable paths frequently include locations consulted during service startup, cron/scheduled execution, or web-accessible script directories, which converts the arbitrary-write primitive into remote code execution. The NVD description explicitly states this leads to RCE and "complete loss of confidentiality, integrity, and availability."

Authentication is required (PR:H), meaning the attacker must hold valid credentials for the web management portal. No user interaction is needed (UI:N), and the attack is network-reachable (AV:N) with low complexity (AC:L). Scope is changed (S:C) because compromise of the management device can impact the serial-connected devices it brokers.

No specific function names, class names, URL paths, or parameter names are provided in the NVD description; therefore this analysis deliberately describes the flaw at the vulnerability-class and control-flow level rather than inventing implementation identifiers.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (authenticated path traversal leading to arbitrary file write / RCE).

1. Reconnaissance / target identification. An attacker identifies exposed Lantronix web management portals (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) reachable over the network — these are typically deployed on management/OOB networks or, insecurely, on internet-facing interfaces. Fingerprinting relies on the portal's login page and product banners.

2. Authentication. The attacker obtains valid credentials for the web management portal. This may be via default/weak credentials, credential reuse, phishing, or prior compromise. The vulnerability is post-authentication (PR:H), so valid access is a precondition.

3. Triggering the traversal. The attacker invokes the file upload function of the web management portal and supplies a filename crafted to contain both a backslash and forward slashes. The sanitization logic strips the backslash but, because it does not then re-check for forward slashes on that branch, permits the resulting name to contain directory-traversal sequences. The uploaded content is written to an attacker-chosen writable path outside the intended upload directory.

4. Execution / post-exploitation. Because arbitrary data can be written to arbitrary writable locations, the attacker can plant content in a location that is later executed or interpreted by the device (for example, a startup or scheduled-execution path), achieving remote code execution on the device. With RCE the attacker gains full control of the management appliance — reading/modifying configuration, capturing or altering serial traffic, and pivoting to or disrupting downstream serial-connected devices (scope change).

Impact Assessment

• Confidentiality: High — full read access to device filesystem, configuration, credentials, and potentially serial session data.
• Integrity: High — attacker can write arbitrary files anywhere writable, modifying firmware-adjacent content, scripts, or configuration.
• Availability: High — arbitrary file write and RCE can render the management appliance inoperable (bricking, service disruption, corrupted startup).
• Scope: Changed — the compromised console server/serial management device can impact the downstream serial-connected devices it manages, extending blast radius beyond the vulnerable component itself.

Business impact is elevated because these products are out-of-band (OOB) management and serial-console infrastructure. A compromised console server can represent a high-value pivot point for controlling network devices, servers, and industrial/legacy serial equipment. CVSS 3.1 base score is 9.1 (Critical). No EPSS score has been assigned by FIRST.org, and the vulnerability is not listed in CISA KEV as of this report. Affected systems include the SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 product families at the firmware versions noted in the metadata.

Detection Guidance

Sigma Rule

title: Lantronix Web Portal File Upload Path Traversal (CVE-2026-80156)
id: 8f3c1a52-2b7e-4e9a-9c11-7a6d5f0b2c44
status: experimental
description: Detects upload requests whose filenames contain both backslash and forward-slash traversal indicators against Lantronix management portals.
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/upload'
      - '/cgi-bin'
  selection_payload:
    cs-uri-query|contains:
      - '..%5c'
      - '..\\'
      - '%5c/'
      - '\\/..'
      - '%2e%2e%5c'
  condition: selection_method and selection_uri and selection_payload
falsepositives:
  - Legitimate filenames containing backslashes from non-Windows-aware clients
level: high

YARA Rule

rule CVE_2026_80156_Lantronix_PathTraversal
{
    meta:
        description = "Detects path traversal filename patterns tied to CVE-2026-80156 in captured upload traffic or logs"
        author = "Threat Intelligence"
        reference = "CVE-2026-80156"
        date = "2026-01-01"
    strings:
        $mix1 = "\\..\\" ascii
        $mix2 = "%5c/..%2f" ascii nocase
        $mix3 = "..%5c%2f" ascii nocase
        $prod1 = "SLC8000" ascii
        $prod2 = "EMG8500" ascii
        $prod3 = "EMG7500" ascii
        $prod4 = "web management portal" ascii nocase
    condition:
        any of ($mix*) and any of ($prod*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-80156 Lantronix Web Portal Path Traversal Upload Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"upload"; nocase; http.request_body; content:"\\"; http.request_body; content:"/"; distance:0; pcre:"/(\.\.(%5c|\\|\/|%2f))|(%5c.*%2f)|(\\\\.*\/)/i"; classtype:web-application-attack; reference:cve,2026-80156; sid:202680156; rev:1;)

Elastic Detection

sequence by host.name
  [ network where http.request.method == "POST" and url.path contains ("upload" or "cgi-bin") ]
  [ network where http.request.body contains ("\\/.." or "..%5c" or "%5c/.." or "..\\") ]

Splunk SPL Query

index=web OR index=proxy
| eval raw=lower(_raw)
| where (match(raw,"post") AND (match(raw,"upload") OR match(raw,"cgi-bin")))
| where (match(raw,"\\/\.\.") OR match(raw,"\.\.%5c") OR match(raw,"%5c/\.\.") OR match(raw,"\.\.\\\\"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, uri_path
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,CVE-2026-80156,">
  <rule id="100156" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>upload|cgi-bin</url>
    <regex>\\/\.\.|\.\.%5c|%5c/\.\.|\\\\\.\.</regex>
    <description>CVE-2026-80156: Possible Lantronix path traversal file upload attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references firmware versions (SLC8000 v9.7.0.5, EMG8500/EMG7500 v9.7.0.1) that appear to correspond to the fixed releases, but there is no confirmed vendor advisory or downloadable patch artifact via tracked sources; treat as unpatched and verify directly with the vendor before relying on these versions.

1. Immediate mitigations

   • Restrict network access to the web management portal — place consoles on a dedicated OOB management network, never internet-facing, and enforce firewall/ACL allowlists.
   • Require strong, unique credentials and rotate any potentially reused/default passwords; disable unnecessary privileged accounts.
   • Monitor for and block upload POST requests whose filenames contain both backslash and forward-slash traversal sequences (see detection rules).
   • Where feasible, disable or restrict the web upload feature if not operationally required.

2. Patch / upgrade steps

   • Contact Lantronix for the authoritative advisory and firmware (SLC8000 v9.7.0.5; EMG8500/EMG7500 v9.7.0.1 referenced in the CVE) and validate applicability.
   • For SLB882/SLCx-03/SLCx-02, no fixed version is identified in the source data; confirm vendor guidance, as all firmware versions are reported affected.
   • Stage upgrades in maintenance windows; the devices are serial-console infrastructure, so plan for service interruption to connected devices.

3. Long-term hardening

   • Treat OOB management devices as tier-0 assets: network segmentation, MFA on portals, centralized logging.
   • Maintain a hardware/firmware inventory for serial-console infrastructure and subscribe to Lantronix security advisories.
   • Enforce least-privilege on management accounts and audit upload/administrative activity.
   • Add compensating web-application controls (reverse proxy that normalizes and rejects traversal in filenames) where the portal must remain exposed internally.

References

1. NVD — CVE-2026-80156: https://nvd.nist.gov/vuln/detail/CVE-2026-80156
2. CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
3. Lantronix product security advisories (verify current status directly with vendor): https://www.lantronix.com/
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (check for future inclusion): https://www.cisa.gov/known-exploited-vulnerabilities-catalog No public PoC, exploit code, or Nuclei template was identified, and there is currently no evidence of an active threat-actor campaign or exploit-in-the-wild. This CVE is not listed in CISA KEV.