A critical stack-based buffer overflow vulnerability in Lantronix management devices, which are often used for sensitive out-of-band infrastructure, allows authenticated attackers to achieve remote code execution and full system compromise.

The vulnerability involves a stack-based buffer overflow triggered by an undocumented mfc eeprom read command that passes unbounded user input to a system call. Attackers must be authenticated to the device terminal or CLI to exploit this flaw.

The exploitation of this vulnerability poses a severe risk to organizational operations, as these devices are typically used for out-of-band management of critical network infrastructure. A successful attack results in complete loss of confidentiality, integrity, and availability, potentially granting the attacker control over serial-attached devices and the ability to pivot into sensitive management networks. Given the CVSS score of 9.9, this vulnerability is classified as critical and requires immediate attention to prevent unauthorized access to high-value infrastructure.

Immediate Action: Update firmware for SLC8000 to version 9.7.0.2 and EMG8500/EMG7500 to version 9.7.0.1 immediately. For end-of-support devices like the SLCx-02 and SLCx-03 series, decommission the hardware as no patches are forthcoming.

Proactive Monitoring: Review device access logs for unusual CLI activity or repeated attempts to execute undocumented commands. Monitor network traffic for anomalous patterns originating from management interfaces.

Compensating Controls: Restrict access to the management CLI and web interfaces to trusted IP addresses only using access control lists. Place these devices behind a secure jump host to ensure that only authorized personnel can interact with the management console.

Public Exploit Available: Yes, a technical write-up detailing the vulnerability mechanism is available via the VulnCheck advisory and the REVRB research report.

Organizations utilizing affected Lantronix devices must prioritize patching or decommissioning based on the vendor guidance provided for each model. Because these devices serve as a secondary path into the network, they are high-value targets for attackers seeking persistence or lateral movement. Administrators should treat this vulnerability with extreme urgency and verify that all internet-facing management interfaces are strictly firewalled.