Lantronix Advanced Console Manager and Edge Management Gateway
Software Release Notes  
Version 9.7.0.0
January 13, 2026
Copyright 2026, Lantronix

Release notes are also available on the Lantronix web site (www.lantronix.com) 
and via anonymous FTP from ftp.lantronix.com.  Contact Lantronix or your 
reseller for more information. 

This document describes the Lantronix EMG firmware release 9.7.0.0.


===============
RELEASE SUMMARY
===============
Current release: 9.7.0.0


=============================
ADDITIONAL PRODUCTS SUPPORTED
=============================
V9.7.0.0 supports the EMG85xxxx Edge Management Gateways.


=================
FIRMWARE RELEASES
=================
file: emgupdate-9.7.0.0R3.tgz
key:  bbf419e46cc425987f120d35b3efdb5d

Do not rename the firmware file - it must retain the same filename in order
for the firmware upgrade to complete successfully.

The firmware can be updated via either the 'Firmware & Configurations' web page,
or with the 'admin ftp' and 'admin firmware' CLI commands.  Updating firmware
via tftp does not use the FTP login, password, or path settings.  The firmware
update will be applied to the alternate boot bank. Downgrading firmware 
versions is not supported.


=====
NOTES
=====

- The Percepxion client is now enabled by default. If a factory default is
  performed and the Percepxion client was not previously enabled, after reboot
  it will be enabled and actively trying to connect to Percepxion.

- The minimum LPM (Lantronix Provisioning Manager) version required for the
  EMG 9.7.0.0 firmware release is 7.2.4.

- The minimum firmware version required on the active firmware bank to upgrade 
  the alternate firmware bank to this firmware release is 8.7.0.2R1 or 
  8.8.0.0R3. Older firmware versions will need to be upgraded to one of these 
  firmware versions before upgrading to 9.7.0.0.


============
NEW FEATURES
============

- IPv6 Support in Performance Monitoring

  Support for IPv6 in the ICMP Echo (ping), UDP Echo, TCP Connect, DNS Lookup
  and HTTP Get probes has been added.

- Network Failover/Failback Enhancements

  Failover/Failback now supports IPv6 addresses for the failover gateway and 
  the failover ping IP address. 

- Firmware Update Enhancements

  Firmware update methods now support IPv6 addresses for FTP and SFTP servers.
  Source IP address selection has been added for firmware updates via FTP and
  SFTP. This selection feature is available only for firmware update methods
  FTP and SFTP. Firmware updates now support using Virtual Interfaces as
  the source IP address.

- The status for NTP now displays the uptime of the NTP application.

- The online help for scripts has been updated with examples of how to send
  SNMP traps and emails from a script.

- Changes to CLI syntax:
  o added srcipaddr and srcipv6addr options to "admin firmware update"


=========
BUG FIXES
=========

- When the cellular connection went up or down, the SNMP generic traps linkUp 
  and linkDown were being sent with an incorrect ifIndex (usually eth2).
  Due inconsistencies with enumerating the cell0 interface in the SNMP IF-MIB
  IF-MIB::ifIndex list, the SNMP generic traps linkUp and linkDown are now
  disabled for the cellular modem. The slcEventCellular enterprise trap
  (added in firmware version 9.1.0.0) should be used instead to monitor all
  cellular modem events.

- The # character is now allowed in TACACS+ secrets.

- The SSH subsystem has been updated to address security vulnerabilities, 
  including CVE-2025-26465 and CVE-2025-26466.

- Periodically WebSSH and WebTelnet (to the CLI or device ports) could not
  be opened. This has been fixed with a watchdog that restarts the server.


==========
KNOWN BUGS   
==========

- When executing the perfmon restart CLI command with a probe name that 
  contains a hyphen, the hyphen will be interpreted as a possible range of
  probe ids, and produce an invalid error. For example:

  [emg4fb6]> set perfmon state tcpconn3922-6-ll action restart
  Invalid state: tcpconn3922-6-ll (please specify a comma-separated list, eg, '1-4,6,11-12').

- CLI "show routing" and "diag" commands may hang waiting for user input
  After issuing the CLI command "show routing" or "diag" commands "arp", 
  "arp6", "lookup", "netstat", "nettrace" or "ping", the CLI may hang waiting 
  for user input when the output from the command would normally be displayed. 
  Pressing any key repeatedly will cause the output to be displayed.

- Cellular Issues
  In some cases, a configured SIM PIN is not retained after reboots, and may
  require configuring the SIM PIN in the UIs again. In rare cases, manually
  configuring the APN with IPv6 disabled (bringing up the cellular interface 
  and acquiring an IPv4 address), then enabling the Clear Predefined APN and
  enabling IPv6 may cause the EMG to become unresponsive; a power cycle is
  required to recover the EMG functionality.


====================
DOCUMENTATION ERRATA
====================

=================
PREVIOUS RELEASES
=================
[ 9.6.0.0 NEW FEATURES ]

- Filtering (Grep) Functionality for CLI show commands

  Support for filtering CLI show command output has been added. Filtering can
  include or exclude patterns, and use regular expressions to match patterns. 
  See "help command line" for more information.

- Failover/Failback Statistics

  Display of network failover and failback statistics is now available - 
  the display shows the number of failover and failback events, and the time 
  of the last failover and failback event.

- SSH ECDSA Public Keys

  Support for SSH ECDSA public keys has been added. Subsections of the CLI
  help for "set sshkey" and "show sshkey" can be viewed instead of the full
  help text: "help set/show sshkey import", "help set/show sshkey export",
  "help set/show sshkey server".

- SSH Server Algorithm Selection

  Individual SSH server ciphers, MACs, KEX algorithms and host key algorithms
  can be enabled or disabled, for additional security. When upgrading to this 
  firmware version the current configuration will be converted to the 
  appropriate individual algorithm selection based on the current SHA2 and 
  Higher, NIST Algorithms and RSA Host Key Algorithms settings. 

- Web Server TLS Cipher Selection

  Individual web server TLS cipher suites can be enabled or disabled, for
  additional security. When upgrading to this firmware version the current
  configuration will be converted to the appropriate individual cipher 
  selection based on the current Cipher and Use only SHA2 and Higher Ciphers 
  setting. Note: TLSv1.3 ciphers cannot be disabled; all TLSv1.3 ciphers 
  should be enabled to be compliant with the TLSv1.3 protocol.

- NTP Authentication

  Any of the NTP local servers can be configured to use NTP Authentication to 
  verify that the local server is known and trusted. The NTP packets are 
  authenticated with symmetric key authentication. See the online help for
  more information.

- APC7900B PDU

  The APC7900B Switched Rack PDU can now be managed via the Outlets web page
  the "set power" CLI command, and Percepxion. The PDU can be connected to 
  either RJ45 serial or USB serial ports.

- CLI help for "set network" and "show network"

  Subsections of the CLI help for "set network" and "show network" can be
  viewed, instead of the full help text: "help set/show network gateway",
  "help set/show network dns" and "help set/show network host".

- Auto Reboot after Kernel Panic and Hardware Watchdog

  The EMG will now automatically reboot after a kernel panic, to minimize
  device downtime. This behavior is configurable with the Panic Reboot option
  on the Maintenance web page and the CLI "admin firmware panicreboot" command.
  By default, this feature is enabled. It is possible for a EMG shutdown to 
  generate a RCU stall (panic) as the CPU has been stopped, and this in turn 
  may cause the EMG to automatically reboot if Panic Reboot is enabled.

  Support for a hardware watchdog has been added to automatically reset the
  EMG if the system locks up. This behavior is configurable with the Hardware
  Watchdog option on the Maintenance web page and the CLI "admin firmware
  hwwatchdog" command. By default, this feature is enabled.

- FIPS Mode

  FIPS mode is supported. SSH server algorithms and web TLS ciphers cannot be 
  changed in FIPS mode (the algorithms and ciphers are configured for FIPS 
  approved algorithms and ciphers).

- Changes to CLI syntax:

  o added type option to "set sshkey export"
  o added ciphers option to "admin web"
  o added sshalgorithms option to "set services"
  o added localserverid, keyindex, hash and localserverkey options to "set ntp"
  o renamed "show services" option viewcipherlist to viewalgorithms
  o removed sha2 and cipher options from "admin web"
  o removed sha2, nist and rsahostkeys options from "set services"
  o added panicreboot and hwwatchdog options to "admin firmware"
  o added dmesg option to "admin clear"

[ 9.5.0.0 NEW FEATURES ]

- Percepxion Web Connect

  Connecting to the EMG Web UI through Percepxion via the "Web" button for a
  device is now supported. Remote web UI sessions to devices on the same subnet
  as the EMG can also be opened (see the Connect tab under EMG details in
  Percepxion). A maximum of 10 web connections can be created under the Connect
  tab, but only 3 connections can be enabled at a time. See Percepxion online
  help for more information on this feature.

- SLC Network Outputs in CSV Format

  The CLI "show slcnetwork" command now has options to output the list of
  devices found in CSV format or without any extra space padding

- Console Port Disable Feature

  The console port can now be disabled - messages will be output during the 
  boot process, but login to the CLI will not be available.

- IPv6 Firewall Support

  Support for IPv6 addresses in IP Filter has been added.

- Additional NTP Servers

  Support for three additional NTP local servers has been added (for a total
  of six NTP local servers).

- Additional DNS Servers

  Support for 6 additional DNS servers has been added (for a total of 10).

- Auto-refresh of Device Port Counters and Status in the Web UI

  The global Device Port settings now have an Auto-refresh Port Counters option
  to enable auto-refresh of port status and counters in the Device Port Settings
  web page.

- Failover with Bonding

  Support for failover while Ethernet bonding is enabled has been added.

- Ansible Interoperability

  Tips for Ansible interoperability have been added to the the Web online help.

- Auto Reboot after Kernel Panic

  The EMG will now automatically reboot after a kernel panic, to minimize
  device downtime. This behavior is configurable with the Panic Reboot option
  on the Maintenance web page and the CLI "admin firmware panicreboot" command.
  By default, this feature is enabled. It is possible for a EMG shutdown to 
  generate a RCU stall (panic) as the CPU has been stopped, and this in turn 
  may cause the EMG to automatically reboot if Panic Reboot is enabled.

- Changes to CLI syntax:

  o added format option to "show slcnetwork"
  o added access option to "set consoleport"
  o added localserver4, localserver5 and localserver6 options to "set ntp"
  o added autorefreshcounters option to "set deviceport global"
  o added panicreboot option to "admin firmware"

[ 9.4.0.0 BUG FIXES ]

- Unresponsive Units

  Fixed a file locking issue that was causing units to become unresponsive

- Percepxion Cloud Host Auto-Updated

  In a previous release the configured Percepxion Cloud Host was auto-updated
  from api.consoleflow.com to api.percepxion.ai during firmware update. This
  could break connectivity for some ConsoleFlow customers. The auto-update of 
  the Cloud Host has been removed.

- SSH Terrapin Vulnerability

  The ChaCha20-Poly1305 cipher has been disabled to fix SSH terrapin 
  vulnerability CVE-2023-48795.

[ 9.3.0.0 NEW FEATURES ]

- ConsoleFlow has been rebranded as Percepxion.

- Integrated PDU Support

  The EMG supports an integrated external PDU to manage power for devices 
  that may (or may not be) connected to the console manager via a serial port. 
  See Devices -> Outlets online help for more information.

- SSH Out to IPv6 Addresses

  SSH out from the CLI to IPv6 addresses and hostnames that resolve to IPv6
  addresses is now supported.

- Protocol Source IP Address Selection

  The source IP address selection for Syslog, DNS, NTP, TACACS+, and SNMP
  have been expanded to include IPv4 and IPv6 addresses for both physical 
  interfaces (Eth1 and Eth2), as well as IPv4 and IPv6 addresses for both
  virtual interfaces (VEth1 and VEth2).

- IPv6 Static Routing

  IPv6 static routes can now be configured. Link local IPv6 gateways require 
  that a scope identifier be specified for the gateway.

- SSH Upgrade

  The SSH server and client applications have been upgraded to include the 
  latest vulnerability fixes.

- FTP Server OTP Option

  A One Time Login/Password option has been added to the Maintenance web UI
  and "admin config" and "admin firmware" CLI commands to bypass saving the
  FTP/SFTP/TFTP server login and password. This is useful in scenarios where
  an OTP token is used to perform a firmware update or configuration save or
  restore.

- FIPS Mode

  FIPS mode is deprecated and cannot be enabled.

- Changes to CLI syntax:

  o added "set power" and "show power"
  o added "set px" and "show px"
  o added "eth1" and "eth2" to "set network dnssrcipaddr" and 
    "set snmp trapsrcipaddr" options
  o added srcipv6addr option to "set tacacs+"
  o added srcipv6addr option to "set ntp"
  o added trapsrcipv6addr option to "set snmp"
  o added dnssrcipv6addr option to "set network"
  o added syslogsrcipaddr and syslogsrcipv6addr options to "set services"
  o added ipv6route option to "set routing"
  o added veth1 and veth2 to "diag ping ethport" and "diag ping6 ethport"
    options
  o added onetimepassword option to "admin firmware", "admin config save" and
    "admin config restore"

[ 9.2.0.0 NEW FEATURES ]

- TACACS+ Port

  The TCP port used for communication to a TACACS+ server can now be configured.

- USB Device Port support for Prolific PL2303GS

  Support for Prolific PL2303GS USB Serial converters has been added for USB 
  Device Ports.

- Configuration Text File Character Escape

  An "escapechar" option has been added to the CLI commands "admin config
  commands" and "admin config batch" to escape any backslash '\' characters
  in the output. If escapechar is enabled with "admin config commands", any 
  '\' character in the output will be prepended with an additional '\'
  character. If escapechar is enabled with "admin config batch", it will handle
  de-escaping (removing the prepended '\') in the input, before running the
  CLI command.

- Ethernet Virtual Interfaces

  Support for two virtual interfaces has been added; these interfaces act
  similar to a real physical interface, with an assigned IP address and 
  netmask. For more information see the online help for Virtual Interfaces. 
  In addition, a virtual interface can be selected as the interface to use 
  for outgoing SSH sessions (CLI command "connect direct ssh"), as well as 
  NTP, SNMP, DNS and TACACS+ packets.

- Ethernet Switch VLANs

  The Ethernet switch now supports up to two VLANs for grouping together a
  subset of devices connected to the switch into a logical network. See the
  VLAN online help for more information.

- Changes to CLI syntax:

  o added port and srcipaddr options to "set tacacs+"
  o added escapechar option to "admin config commands" and "admin config batch"
  o added "set virtual" and "show virtual"
  o added iface option to "connect direct ssh"
  o added srcipaddr option to "set ntp"
  o added trapsrciface option to "set snmp"
  o added dnssrcipaddr to "set network"
  o added iface option to "connect direct ssh"
  o added "set switch vlan" and "show switch vlan"

[ 9.2.0.0 BUG FIXES ]

- SSH Public Keys (Imported)

  An issue that allowed users to SSH to the EMG as a user other than the
  one defined for an SSH public key has been fixed.

[ 9.1.0.0 NEW FEATURES ]

- SSH Algorithm Features

  Two options to control which algorithms are supported by the SSH server have 
  been added: RSA Host Key Algorithms (enables or disables support for RSA
  server host key algorithms; enabled by default) and NIST Algorithms (enables
  or disables NIST Key Exchange algorithms and server host key algorithms;
  enabled by default).
  
- SSH Upgrade

  The SSH server and client have been upgraded to a more secure version. DSA
  SSH keys are no longer supported. NOTE: due to the removal of less secure
  algorithms, users with older SSH clients may not be able to connect to the
  EMG via SSH after this firmware version is installed. If a SSH client cannot
  connect to the EMG, most SSH clients can be run in verbose or debug mode 
  which will display what algorithms the client is offering to the EMG SSH 
  server and the reasons for connection failure. SSH connections out of the
  EMG to older SSH servers may also fail to connect.
  
- IP Filter Rule Limit

  The maximum number of rules allowed in an IP filter ruleset has been changed; 
  256 rules are now supported.
  
- Syslog Version Format

  The system log format has been upgraded from RFC3164 to RFC5424. This upgrade
  applies to the format of the system log files stored internally as well as 
  the format of the system log messages sent to a remote syslog server. For
  example, the RFC3164 syslog format:
  
  Mar  8 11:55:44 2023 emgfc31 SLC-SLB/xasd: sw/info-Running logrotate
  
  The RFC5424 format:
  
  2023-03-08T11:55:44.027127+00:00 emgfc31 SLC-SLB/xasd: sw/info - Running logrotate

  After installing this release, booting to a bank running an older firmware 
  version will result in logs with both RFC3164 and RFC5424 format logs in 
  the system log, and the older firmware version will not be capable of date 
  sorting both formats.
  
- Discovery Server for Secure Lantronix Network

  The capability to disable the discovery server that listens for requests
  to search the network for Lantronix devices has been added.

- Sysinfo Diagnostics Auto Feature

  An 'auto' option has been added to the CLI "admin sysinfo" option to support
  saving sysinfo files in a CLI batch script. For example, a script that saves
  a sysinfo file every 60 seconds:

  [emg]> show script type batch name auto_sysinfo
  ___Batch Script 'auto_sysinfo'_______________________________________________
  Group/Perms: Adm/ad,nt,sv,dt,lu,ra,um,dp,ub,rs,fc,dr,sn,wb,sk,do,sd,md,rp,di
  set cnt 5
  while { $cnt >= 1 } {
      admin sysinfo save EMGsysinfo location usb auto enable
      sleep 60
      set cnt [expr $cnt - 1]
  }

- SSH Two Factor Authentication

  SSH 2FA has been added; when enabled, this requires users to configure a
  public key in addition to entering a password when authenticating to the EMG.
  
- SNMP Cellular Link Up / Down Trap

  A SNMP trap has been added for cellular link up and down events.

- Cellular MTU Configuration

  The MTU for the cellular connection can now be configured; this may improve
  the quality of some cellular connections.

- Speed Test Diagnostics

  A network performance test (via speedtest.net) has been added to the CLI 
  to test performance of various network configurations, including performance 
  of a cellular connection. See "diag speedtest" for more information. 

- Cellular Firmware Over The Air (FOTA)

  Support for cellular FOTA has been added to update the cellular modem
  firmware. See the online help for more information.

- SSH Server Host Keys

  The SSH server host keys can be removed with a CLI command; on reboot, the
  EMG will automatically regenerate the SSH server host keys.

- SNMP Resource Utilization Traps

  Traps for resource (disk and memory) have been added; the traps are sent
  when the resource goes over 90% utilization.
  
- Changes to CLI syntax:

  o added nist, rsahostkeys and discoveryserver options to "set services"
  o removed dsakeys option from "set services"
  o removed dsa from "set sshkey" and "show sshkey"
  o added "clear updatelog" to "set cflow"
  o added allusers option to "set cli"
  o added auto option to "admin sysinfo"
  o added mtu option to "set cellular"
  o added basic option to "show cellular"
  o added "diag speedtest"
  o added "set cellular fota" and "show cellular fota"
  o added "set sshkey server remove"

[ 9.1.0.0 BUG FIXES ]

- SNMP link up/down trap using incorrect interface index

  The EMG was sending an incorrect ifIndex when issuing an SNMP linkUp or
  linkDown trap; this has been fixed.

- Logging and diagnostics for directory full

  Additional logging and diagnostics has been added for tracking when a
  partition is full.

[ 9.0.0.0 NEW FEATURES ]

- StarTech USB External Modem

  Support for an external USB 2.0 modem (StarTech USB 2.0 USB56KEMH2) has been 
  added.

- ConsoleFlow Audit Log

  Audit log messages are now pushed to the ConsoleFlow server by the ConsoleFlow
  client. This feature is enabled by default, and can be enabled or disabled
  with the Audit Log Messages setting for the ConsoleFlow client.

- SNMP v3 Encryption

  Support for AES192 and AES256 has been added to the SNMP v3 encryption 
  options.

- Changes to CLI syntax:

  o added auditlogmessages option to "set cflow"
  o added aes192 and aes256 options to "set snmp v3encrypt" options

[ 9.0.0.0 BUG FIXES ]

- ConsoleFlow Proxy Connections

  When configured with a proxy server, the ConsoleFlow client was not using
  the proxy server for remote connections. This has been fixed in this release.

- Command to reset a Device Port

  The command to reset a device port via the CLI did not fully reset the 
  serial side of connections to the device port. This has been fixed in
  this release.

[ 8.9.0.0 NEW FEATURES ]

- ConsoleFlow Proxy

  The ConsoleFlow client now supports use of a proxy server to act as a
  gateway between the ConsoleFlow client and the ConsoleFlow server. HTTP
  and SOCKS5 proxy servers are supported.

- Changes to CLI syntax:

  o added proxy options to "set cflow"
  o added ConsoleFlow connection test command "show cflow connecttest"

[ 8.9.0.0 BUG FIXES ]

- A fix for CVE-2022-0778 (OpenSSL BN_mod_sqrt DoS) has been applied to the
  OpenSSL library.

- The ConsoleFlow client can periodically lose connection to the ConsoleFlow
  server even when there are no network / routing issues due to libwebsockets
  ping-pong keepalive issues. This issue has been resolved by disabling 
  libwebsockets ping-pong keepalives in favor of MQTT ping-pong keepalives.

[ 8.8.0.0 NEW FEATURES ]

- Modem White List

  A list of allowed phone numbers can be used to control dial-in access to an
  internal modem or USB modem. The access list can be configured to either
  ignore or hang up phone numbers which are not on the access list.

- USB Serial Support on front USB port

  The front USB port now support connecting serial devices. The user can login
  to the CLI and perform a "connect direct U1" to interact with the device.

- RPM support for APC 7900B and 8865 PDUs

  Management for APC 7900B and 8865 PDUs via SNMP has been added. Total current
  for the PDU can be displayed; however the PDU does not support displaying
  current for each outlet.

- Forwarding from Cellular Interface

  For EMGs with cellular modems, forwarding connections from the cellular
  modem interface can be created.

- Changes to CLI syntax:

  o added allowremoteconnection option to "set cflow"
  o added "diag traceroute6"
  o removed mqttsecurity option from "set cflow"
  o added "show usb serial" and "set usb serial"
  o added "set accesslist" and "show accesslist"

[ 8.8.0.0 BUG FIXES ]

- Web Server Cookie Security

  Security issues related to web server session cookies have been fixed.

[ 8.7.0.2 BUG FIXES ]

- Firmware Update Issue with 8.7.0.1

  Firmware update on EMGs running 8.7.0.1R1 fails with the error "Cannot create
  ramdisk (mke2fs). The EMG may not be able to reserve enough memory to perform
  the firmware update." This issue has been fixed in this release. It is
  recommended that the EMG be booted to the boot bank *not* running 8.7.0.1R1,
  and update the bank running 8.7.0.1R1 to 8.7.0.2R1.

[ 8.7.0.1 BUG FIXES ]

- ConsoleFlow Connection Issues

  Fixes for ConsoleFlow connection issues, including the “SSL: couldn't create
  a context” error. This caused telemetry to not be updated and some operations
  (for example, CLI Commands) to not run.

[ 8.7.0.0 NEW FEATURES ]

- Managed Ethernet Switch

  Support for an integrated 4 port Ethernet Switch has been added. This switch 
  can be used as a management LAN to provide secure access to network devices
  that are attached to it. See online help for more details.

- DHCP Server & Relay

  DHCP Server and DHCP Relay are supported on the Ethernet Switch. See online
  help for more details.

- Changes to CLI syntax:

  o added "set dhcp" and "show dhcp"
  o added "set switch"
  o added starttime, endtime, display and numlines options to "show auditlog"

[ 8.7.0.0 BUG FIXES ]

- Ethernet Bonding

  Previously when Ethernet Bonding was enabled and set to active backup, it was
  displayed as being in load balancing mode. This has been resolved.
