A critical stack-based buffer overflow vulnerability in Lantronix out-of-band management devices allows authenticated attackers to achieve remote code execution and full system compromise.

This vulnerability is a stack-based buffer overflow triggered by an undocumented mfc eeprom write command, which copies unbounded user input into a fixed-size stack buffer. Any authenticated user accessing the terminal or CLI interface can trigger this overflow to execute arbitrary code with system privileges.

Successful exploitation allows an attacker to gain full control over the affected out-of-band management device. Given that these devices are typically used to manage critical infrastructure, serial-attached servers, and networking hardware, this vulnerability poses a severe risk of data exfiltration, lateral movement into sensitive segments, and total loss of availability for managed downstream assets. With a CVSS score of 9.9, this is a critical security event that requires immediate attention.

Immediate Action: Update SLC8000 firmware to version 9.7.0.2 and EMG8500/EMG7500 firmware to version 9.7.0.1 immediately. For end-of-support devices like the SLCx-02 and SLCx-03, decommission the hardware as no patches are expected.

Proactive Monitoring: Monitor device access logs for unusual CLI activity or repeated authentication attempts followed by service instability. Review system logs for signs of process crashes or unexpected reboots.

Compensating Controls: Restrict access to the management CLI and web interfaces to trusted administrative workstations only. Implement strict network segmentation to ensure these management devices are not exposed to untrusted network segments.

Public Exploit Available: Yes — a published technical write-up by RE/VRb contains the attack details and mechanism, which constitutes a functional proof-of-concept for this vulnerability.

The severity of this vulnerability, combined with the critical role these devices play in network management, necessitates an immediate patching cycle for all supported models. Organizations should prioritize the identification of affected devices in their environment and execute firmware updates without delay. For older, unsupported hardware, immediate decommissioning is the only viable path to mitigate this risk.