Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass

published 2026-09-22 48 d ago modified 2026-09-24 45 d ago also EUVD-2026-84520

cvss: 9.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits: 0; none known

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 48 d ago (2026-09-22)

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.9	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA	4.0	8.9	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

LANTRONIX SLC8000
LANTRONIX EMG8500
LANTRONIX EMG7500
LANTRONIX SLB882
LANTRONIX SLCx-03
LANTRONIX SLCx-02
LANTRONIX SLC9000

Classification

Weakness

CWE-330 Use of Insufficiently Random Values

References

revrb.net /2026/09/21/revrb-lantern.html
technical-description
vulncheck.com /advisories/lantronix-autonomous-out-of-band-devices-predictable-session-token-with-validation-bypass
third-party-advisory

Sources

CVE List CVE-2026-80154
NVD CVE-2026-80154

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary