Lantronix xPrintServer: The device ships with a hardcoded root account baked into every unit of a given firmware line

Impact

The device ships with a hardcoded root account baked into every unit of a given firmware line. Anyone who can reach the management interface gets root on the box without needing to guess or phish a credential — it's the same key for every deployed unit.

Who can reach it

No authentication needed beyond network reachability to the device; the credential is embedded in firmware and identical across all units running the affected build.

What to do

Firmware flash to 5.0.1-65 or later on every affected unit — this isn't something a config change or password rotation fixes, since the account is compiled into the image. Budget one flash-and-reboot cycle per device; xPrintServer's main job (serial/print bridging) is unavailable during the flash.

References