A critical authentication bypass vulnerability in multiple Lantronix management devices allows unauthenticated attackers to gain full remote control, posing a severe risk to critical infrastructure and out-of-band management networks.

The web management portal suffers from an improper path traversal flaw (CWE-22) in the file upload endpoint, where the use of snprintf with a fixed-size buffer allows an unauthenticated attacker to manipulate session cookie file paths. By forcing path truncation, an attacker can bypass authentication validation and perform arbitrary file writes, leading to full system compromise.

This vulnerability carries a CVSS score of 10.0, representing the maximum level of severity. Successful exploitation grants an attacker complete control over the affected device, enabling them to compromise sensitive configuration data, manipulate serial-connected infrastructure, and gain a foothold within secure management networks. This could result in unauthorized access to critical physical systems, significant data breaches, and extended operational downtime for organizations relying on these devices for out-of-band management.

Immediate Action: Administrators of SLC8000, EMG8500, and EMG7500 must update to firmware versions 9.7.0.5 or 9.7.0.1 respectively. Owners of end-of-support devices, including the SLB882, SLCx-03, and SLCx-02, should immediately disconnect these devices from the network or isolate them behind strict access controls as no patches are available.

Proactive Monitoring: Review device access logs for unusual patterns, such as multiple failed authentication attempts or unexpected file upload activity targeting the web management portal. Monitor network traffic for anomalous connections originating from or directed toward the management interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network security control to filter and block traffic containing malicious path traversal sequences in cookie parameters. Ensure these devices are never directly exposed to the public internet and are restricted to management-only VLANs with strictly enforced access lists.

Public Exploit Available: Yes — the vulnerability details, including the technical mechanism for path traversal and exploitation, were published in a security research write-up by RE/VRb LLC.

The severity of this vulnerability cannot be overstated, particularly for organizations using these devices for out-of-band management in data centers or critical infrastructure. Organizations must prioritize the immediate application of vendor-supplied firmware updates where available. For legacy devices lacking patches, immediate physical or logical isolation is required to prevent unauthorized access and potential lateral movement into protected management segments.