CVE-2026-80154 Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass
Attackers can derive predictable session tokens to bypass authentication and IP validation, gaining elevated privileges on Lantronix out-of-band devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-80154?
CVE-2026-80154 is a high-severity authentication bypass vulnerability in LANTRONIX EMG7500, published on 22 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-second resolution, resulting in a small enumerable set of possible active tokens. Attackers can construct a crafted URI that exploits file extension handling in the web server path routing to bypass per-session source-address validation, then use a derived token from a different source address to gain elevated privileges on the affected device and potentially impact downstream serial-attached devices.
Weakness: CWE-330
Which versions are affected by CVE-2026-80154?
How do I fix CVE-2026-80154?
No fix has been published for CVE-2026-80154 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-80154 being exploited?
There is no known exploitation of CVE-2026-80154 in the wild and no public exploit code.
Sources
Also known as GHSA-c7q9-4pfw-ph5m.