Affected Vendors
- Lantronix: 13 CVEs (10 critical, 3 high)
- Ubiquiti: 6 CVEs (all high)
- OpenWrt / DD-WRT: 2 CVEs (all high)
- ASUS: 2 CVEs (unscored)
- Fortinet: 1 CVE (critical)
- Cisco: 1 CVE (unscored)
Critical Alert: Lantronix Serial Console Servers Under Siege
This week saw a critical vulnerability flood affecting Lantronix serial console and embedded management devices. Ten critical vulnerabilities have been disclosed, affecting the SLC8000, SLC9000, EMG8500, EMG7500, SLB882, and SLCx-series devices. Organizations managing remote infrastructure with Lantronix appliances should treat this as an urgent priority.
The most severe issue is CVE-2026-80155 (CVSS 10.0), an authentication bypass in the web management portal affecting SLC8000 before v9.7.0.5, SLC9000 before v9.7.0.2, EMG8500/EMG7500 before v9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02. A perfect 10.0 score means unauthenticated remote attackers can gain full administrative access.
Compounding the problem are multiple command injection flaws—CVE-2026-80143, CVE-2026-80144, CVE-2026-80151, and CVE-2026-80152 (all CVSS 9.1–9.9)—plus stack-based buffer overflow vulnerabilities (CVE-2026-80146 and CVE-2026-80147, both CVSS 9.9) and path traversal exposure (CVE-2026-80156, CVSS 9.1). An unauthenticated attacker could chain these for complete device compromise.
Critical devices with "all firmware versions" exposure (SLB882, SLCx-03, SLCx-02) have no patch available yet. For SLC8000 and SLC9000 users, firmware updates to v9.7.0.5 and v9.7.0.2 respectively are now available and should be deployed immediately. EMG8500/EMG7500 users should update to v9.7.0.1 or later.
Immediate action items:
- Audit your network for exposed Lantronix devices; these are typically management appliances and should never be internet-facing
- Check firmware versions immediately against the thresholds listed above
- Apply available patches without delay
- For devices with no patch available, implement strict network access controls and consider disabling web management if out-of-band access is available
- Review access logs for any unauthorized access attempts
Ubiquiti UniFi Gateways: Six Memory Safety Issues
Ubiquiti released six high-severity vulnerabilities (all CVSS 7.5) affecting UniFi gateway devices. These include uncontrolled recursion (CVE-2026-95861), out-of-bounds write flaws (CVE-2026-95862, CVE-2026-77544, CVE-2026-77555), and out-of-bounds read vulnerabilities (CVE-2026-77556, CVE-2026-77558). While rated "high" rather than critical, these memory safety issues could allow local network attackers to execute code on gateway devices.
Check your UniFi controller for available firmware patches and schedule updates for affected gateways in your fleet.
OpenWrt and Fortinet Extensions
CVE-2026-55159 (CVSS 8.8) affects luci-app-adblock-fast before v1.2.4, and CVE-2026-55897 (CVSS 8.8) impacts luci-app-advanced-reboot on OpenWrt. Both are high-severity and warrant updates if you use these community packages.
Fortinet's CVE-2026-84388 (CVSS 9.6) is a clickjacking vulnerability in FortiPAM Chrome Extension versions 7.4 and 8.0. While not a router CVE directly, it affects managed infrastructure. Update the extension to the patched version.