Lantronix SLC8000 devices before firmware v9.7.0.3, EMG8500/EMG7500 before v9.7.0.1, and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. The custom shellinaboxd service uses the rooturl parameter from the web connection to determine its IP address. By modifying this parameter, an unauthenticated attacker can redirect the Telnet terminal connection to arbitrary hosts or IPs, potentially allowing internal network reconnaissance or communication with otherwise inaccessible endpoints.

An unauthenticated attacker can exploit this SSRF vulnerability to cause the affected device to establish Telnet connections to arbitrary endpoints controlled by the attacker. This can lead to unauthorized internal network reconnaissance or communication, potentially exposing sensitive internal systems or services that are normally protected from external access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict external access to the WebSSH/WebTelnet listener and monitor for unusual Telnet connection attempts originating from the device.