A critical Server-Side Request Forgery vulnerability in Lantronix out-of-band management devices allows unauthenticated attackers to probe internal networks via the device's SSH functionality.

The flaw exists in the shellinaboxd component, where an overlong username string triggers a buffer truncation in a snprintf call, causing the device to redirect SSH connection targets. This allows an unauthenticated attacker to bypass network perimeters and interact with internal endpoints that are otherwise inaccessible.

Successful exploitation of this vulnerability poses a significant risk to organizational security, as it provides an attacker with a bridge into trusted management networks. By leveraging these out-of-band management devices, an actor can enumerate and communicate with sensitive internal infrastructure, potentially leading to unauthorized system access or data exfiltration. Given the CVSS score of 8.6, this is considered a high-severity issue that could lead to widespread compromise of internal network segments.

Immediate Action: Update affected SLC8000 and EMG-series firmware to the versions specified in the vendor advisory (v9.7.0.2 or higher for SLC8000, and v9.7.0.1 or higher for EMG8500/EMG7500). For the SLB882, where no patch is currently available, administrators should immediately restrict network access to the device management interface.

Proactive Monitoring: Review device access logs and network traffic for anomalous SSH connection attempts originating from the management devices toward internal network segments.

Compensating Controls: Implement strict network-level access control lists (ACLs) to ensure the WebSSH/WebTelnet management interfaces are only accessible from trusted administrative IP addresses, effectively isolating the vulnerable ports.

Public Exploit Available: No (exploit_available: unknown)

Organizations utilizing Lantronix out-of-band management hardware must prioritize the application of provided firmware updates immediately to close this SSRF vector. For legacy devices like the SLB882 that lack available patches, immediate network segmentation or decommissioning is required to prevent unauthorized access to sensitive internal infrastructure.