A critical command injection vulnerability in multiple Lantronix management devices allows authenticated attackers to gain full root-level control over the system.

The flaw exists in an undocumented mfc eeprom write command that fails to sanitize user input before passing it to a system call. Any authenticated user on the terminal or CLI interface can leverage this to execute arbitrary shell commands with root privileges.

Successful exploitation results in a total compromise of the affected device, leading to a complete loss of confidentiality, integrity, and availability. Because these devices are used for out-of-band management, an attacker gaining root access can manipulate the serial-attached infrastructure they manage, potentially impacting critical data center or network hardware. With a CVSS score of 9.9, this vulnerability represents an extreme risk to infrastructure stability and security.

Immediate Action: Update SLC8000 to firmware v9.7.0.2 and EMG-series devices to v9.7.0.1 immediately. For end-of-support models like the SLCx-02 and SLCx-03, decommission the devices as no patches are expected.

Proactive Monitoring: Monitor device logs for unusual command execution patterns or unauthorized attempts to access the CLI and terminal interfaces. Watch for suspicious process creation originating from management services.

Compensating Controls: Restrict access to the management CLI and web interfaces to trusted administrative workstations only. Implement network-level segmentation to ensure these devices are not accessible from untrusted network segments.

Public Exploit Available: No (exploit_available: unknown)

Given the critical severity of this flaw and its potential to compromise the management layer of your network, immediate action is required. Organizations using affected Lantronix hardware must prioritize firmware updates or, where hardware is end-of-support, replace the devices to prevent unauthorized root-level access.