Lantronix PremierWave 2050 console server (Web Manager): An attacker who can log into the web management console gets

Impact

An attacker who can log into the web management console gets a shell on the console server itself, running with the same privileges as the web daemon. From there they can pivot to every serial-attached device the box terminates, and use the console server as a jump box into the rest of the OOB network.

Who can reach it

Needs an authenticated session to the Web Manager (any role), then sends a crafted HTTP request to the Diagnostics: Traceroute page. The traceroute target field isn't sanitized before being handed to a shell, so shell metacharacters turn it into arbitrary command execution.

What to do

Firmware upgrade required (Lantronix has patched builds past 8.9.0.0R4) plus a reboot of each unit; no config workaround exists since the flaw is in the diagnostics handler itself. Roll out per-device, one console server at a time — each reboot drops active serial sessions to whatever racks it terminates.

References