The vulnerability is a stack-based buffer overflow triggered by an undocumented 'mfc eeprom read' command in Lantronix SLC8000 and related devices. Authenticated users can supply oversized input to this command, which copies data without proper bounds checking into a stack buffer before invoking a system() call. This allows attackers to execute arbitrary code with elevated privileges. Affected devices include Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before v9.7.0.1, and all firmware versions of SLB882, SLCx-03, and SLCx-02. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary code execution on the affected device, resulting in full compromise of confidentiality, integrity, and availability. This includes potential control over downstream serial-attached devices, which may be critical to operational environments relying on these devices.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated access to the device interfaces and monitor for suspicious activity related to the undocumented EEPROM read command.