A critical command injection vulnerability in multiple Lantronix management devices enables authenticated attackers to gain full root control and potentially compromise downstream serial-attached infrastructure.

The flaw exists due to improper neutralization of user input within an undocumented MFC EEPROM read command, which is passed directly to a system call. Any authenticated user with access to the CLI or terminal interface can leverage this to execute arbitrary commands with root privileges.

Successful exploitation results in a complete loss of confidentiality, integrity, and availability for the affected management device. Given that these devices are frequently used for out-of-band management of critical network and physical infrastructure, an attacker gaining root access can pivot to downstream serial-attached equipment, leading to widespread network disruption or unauthorized physical control. With a CVSS score of 9.9, this vulnerability represents an extreme risk to organizational security.

Immediate Action: Update SLC8000 to version 9.7.0.2 and EMG-series devices to 9.7.0.1 immediately. For end-of-support models like the SLCx-02 and SLCx-03, decommission the hardware or isolate it from all network access, as no patches will be provided.

Proactive Monitoring: Review system and CLI access logs for suspicious command strings or anomalous EEPROM-related function calls. Monitor for unauthorized configuration changes or unexpected outbound connections originating from management devices.

Compensating Controls: Restrict access to the CLI and web management interfaces to trusted administrative IP addresses only. Implement strict role-based access control to limit the number of users who can authenticate to these devices.

Public Exploit Available: Yes — technical details and attack mechanisms are documented in the research write-up by RE/VRb.

Organizations must prioritize the remediation of this vulnerability due to the critical nature of out-of-band management hardware and the potential for total system compromise. Administrators should immediately apply the provided firmware updates where available, and strictly follow the vendor recommendations to decommission end-of-support devices, as they remain permanently vulnerable to this command injection flaw.