Lantronix console servers: command injection in the NFS download CLI yields root on the out-of-band management device

Impact

The CLI's 'set nfs download' command passes unsanitized input to system(), so an authenticated user holding the services permission gets arbitrary shell commands as root on the console server. These devices sit on the management network and hold serial console access to the servers, switches and PDUs behind them, so root on the console server means a foothold on the out-of-band path itself and the ability to reach downstream serial-attached equipment - including BIOS and BMC consoles that assume physical-equivalent trust. The CVSS 4.0 vector rates subsequent-system confidentiality, integrity and availability all high, reflecting that downstream reach. SLB882, SLCx-03 and SLCx-02 have no fixed firmware at all.

Who can reach it

An attacker who can reach the device's terminal or CLI interface - in practice anyone on the management VLAN - and who authenticates with an account holding the services permission. Authentication is required.

What to do

Flash firmware: SLC8000 to v9.7.0.3, SLC9000 to v9.7.0.2, EMG8500/EMG7500 to v9.7.0.1, images on the Lantronix FTP site. A console-server flash takes the out-of-band path for its attached racks out of service during the reboot, so schedule it when you do not need serial access. SLB882, SLCx-03 and SLCx-02 have no fix in any firmware version - for those, mitigate only: keep the management interface off any routable network, and stop granting the services permission to accounts that do not need it.

References

Related entries

• Arista EOS (redundant supervisor, RPR/SSO): On modular chassis with dual supervisors running RPR or SSO redundancyCVE-2023-24509 · Arista EOS (redundant supervisor, RPR/SSO)Critical
• Software House iSTAR Ultra firmware verification and web application (tested through 6.9.2): The controller verifiesCVE-2025-53696 · Software House iSTAR Ultra firmware verification and web application (tested through 6.9.2)Critical
• Riello NetMan 204: unauthenticated admin pages allow UPS shutdown and config disclosureCVE-2025-71318 · Riello UPS NetMan 204 network management card (admin pages and command endpoints)Critical
• Arista CloudVision Portal: unvalidated Fileserver upload stores XSS that hijacks admin sessionsCVE-2026-101158 · Arista CloudVision Portal (Fileserver upload API)Critical
• Junos OS on SRX: heap overflow in the SVR path lets unauthenticated IPv4 packets crash or compromise the firewallCVE-2026-101950 · Juniper Junos OS on SRX Series (Secure Vector Routing packet path)Critical
• Junos J-Web: unauthenticated attacker gains root-level configuration access to the deviceCVE-2026-101954 · Juniper Junos OS / Junos OS Evolved J-Web (NETCONF session handling)Critical