Lantronix SLC/EMG/SLB firmware vulnerabilities

Lantronix SLC8000 (before firmware v9.7.0.5), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint. An authenticated attacker can write arbitrary data to any location on the device's filesystem, leading to remote code execution.

Lantronix SLC8000 (before firmware v9.7.0.5), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint. An unauthenticated attacker can read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker with the services permission can execute arbitrary shell commands as root via the 'set script schedule' command, which passes unsanitized user input to a system() call.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker with the services permission can execute arbitrary shell commands as root via the 'set nfs download' command, which passes unsanitized user input to a system() call.

Lantronix SLC8000/SLC9000 (before firmware v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker with the services permission can execute arbitrary shell commands as root via the 'set cifs password' command, which passes unsanitized user input to a system() call.

Lantronix SLC8000/SLC9000 (before firmware v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker can execute arbitrary shell commands as root via the undocumented 'mfc eeprom write' command, which passes unsanitized user input to a system() call.

Lantronix SLC8000/SLC9000 (before firmware v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability. An authenticated attacker can execute arbitrary shell commands as root via the undocumented 'mfc eeprom read' command, which passes unsanitized user input to a system() call.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. An unauthenticated attacker can modify the rooturl parameter to redirect the Telnet connection to an arbitrary host or IP. This enables enumeration of and communication with internal network endpoints.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. An unauthenticated attacker can modify the rooturl parameter to redirect the SSH connection to an arbitrary host or IP. This enables enumeration of and communication with internal network endpoints.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. The custom shellinaboxd builds its SSH connection target using snprintf with user-supplied input; supplying an overlong username truncates the device IP suffix and redirects the connection to an arbitrary host. This enables enumeration of and communication with internal network endpoints.