Lantronix G520 Series Cellular Gateway

1. Executive summary

Two HIGH-severity vulnerabilities in the Lantronix G520 Series Cellular Gateway (CVE-2026-84409, CVSS 3.1 7.5 / CVSS 4.0 7.7; CVE-2026-91191, CVSS 3.1 7.5 / CVSS 4.0 7.7) allow an attacker to replace device software and execute arbitrary code with root privileges. The affected version is 2.6.0.4R6_stable; Lantronix has fixed both issues in 2.6.0.7R6. CISA reports no known public exploitation targeting these vulnerabilities at the time of publication, and there is no CISA KEV entry for either CVE. The exposure for EMEA financial services is indirect but concrete: these gateways sit in transportation, energy and water/wastewater environments, so any bank, insurer or market operator that depends on those sectors, or that runs G520 units in branch, ATM or remote-site connectivity, inherits the risk. The signature-verification flaw is the more durable problem, because an exposed production signing key remains trusted even after the firmware is updated.

2. Regulatory framing

No DORA incident-reporting article is engaged on the facts available: CISA states no known public exploitation, so there is no incident to classify or report at this time.

3. Technical analysis & attack chain

Both vulnerabilities are in the G520 Series firmware, version 2.6.0.4R6_stable. CISA published the advisory on 2026-09-29; Ievgen Bondarenko reported the issues. The two flaws chain: one lets attacker-controlled data reach the administrative interface, the other lets an attacker sign packages the device will accept.

Confirmed attack chain for CVE-2026-84409 (CWE-79, cross-site scripting):

1. The device's update mechanism retrieves software-update metadata over an unencrypted HTTP connection.
2. The device stores portions of that metadata for later use.
3. A management interface returns the stored value in a JSON response.
4. The web interface that displays update information inserts that value directly into the page as HTML, so attacker-controlled metadata is interpreted as script content.
5. The same authenticated origin exposes an interface that executes system-level commands with root privileges.
6. An attacker who can influence the update metadata uses that command interface to execute arbitrary code in the device's administrative context.

The initial access vector is the unencrypted HTTP metadata fetch. An attacker positioned to intercept or spoof that traffic (on-path, or controlling the update source) supplies metadata that the device later renders as script. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H: network-reachable, high attack complexity, no privileges required, user interaction required, high impact to confidentiality, integrity and availability. The CVSS 4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N.

Confirmed attack chain for CVE-2026-91191 (CWE-347, improper verification of cryptographic signature):

1. During the boot process, the stock done function disables signature verification in the OPKG configuration.
2. The device then restores optional packages from a writable, unsigned feed.
3. Separately, the publicly distributed SDK contains the production private key whose corresponding public key is trusted by both stable and beta firmware builds.
4. An attacker who can supply a package to the unsigned feed, or who signs a package with the exposed production key, delivers a package the device accepts as authentic.
5. Installation of that package can execute arbitrary code with root privileges.

The two conditions are independent. Restoring signature enforcement closes the boot-time path but not the key path: the exposed production key lets an attacker generate signatures the device continues to trust. That is why firmware replacement alone does not fully resolve the exposure, and why the signing key must be treated as compromised until Lantronix confirms rotation.

The CVSS 3.1 vector for CVE-2026-91191 is identical to CVE-2026-84409 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). The CVSS 4.0 vector differs only in the subsequent-system fields: SC:N/SI:N/SA:N for CVE-2026-91191 versus SC:L/SI:L/SA:N for CVE-2026-84409.

Unconfirmed and single-sourced points. The entire technical description rests on one source, the CISA ICS advisory ICSA-26-272-01. No independent vendor write-up, exploit code or telemetry corroborates the mechanism. CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to it, so there is no observed in-the-wild activity to describe. No indicators of compromise, no command-and-control infrastructure and no named threat actor appear in the source. There is no attribution to report.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory every Lantronix G520 Series gateway (G526, G526RP, G527, G528) on the estate and record the running firmware version. Any unit on 2.6.0.4R6_stable is affected.
• Where a G520 cannot be patched immediately, block its outbound access to the update metadata source and to any writable package feed, and restrict management-interface access to a dedicated management VLAN reachable only from trusted hosts.
• Treat the production signing key shipped in the public SDK as compromised. Do not rely on signature verification alone to gate package installation on any G520 until Lantronix confirms key rotation.

P2 (within 72 hours)

• Upgrade affected units to firmware 2.6.0.7R6, available from the Lantronix firmware page: https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/1889828865/Latest+firmware+for+the+G520+Series+G526+G526RP+G527+G528
• After upgrade, confirm the OPKG configuration has signature verification enabled and that no writable unsigned feed remains configured. Verify the boot-time done function no longer disables verification.
• Review device logs for package installations or update-metadata fetches that did not originate from the approved update source.

P3 (within 7 days)

• Raise the update-channel weakness with Lantronix support (Support@lantronix.com) and ask for written confirmation that the production key has been rotated and that update metadata is served over an authenticated channel.
• Add the G520 to the third-party risk register under DORA Art. 28 and record the vendor's response.
• Check the Lantronix Vulnerability Library for any follow-up advisory: https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/

5. Indicators of compromise

No indicators of compromise available in the source material. The CISA advisory provides no hashes, domains, IP addresses, file paths or registry keys. There is no reported exploitation to derive behavioural indicators from.

6. Detection

Insufficient indicators to author detection rules. The source provides no distinctive strings, command-line flags, file names, registry keys or network artefacts tied to the vulnerabilities. The only named artefacts are the firmware version (2.6.0.4R6_stable) and the fixed version (2.6.0.7R6), which are version identifiers, not threat artefacts, and would not support a reliable rule.

7. Sources

• CISA, "Lantronix G520 Series Cellular Gateway", ICSA-26-272-01, 2026-09-29. https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-01
• Lantronix, "Latest firmware for the G520 Series (G526, G526RP, G527, G528)". https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/1889828865/Latest+firmware+for+the+G520+Series+G526+G526RP+G527+G528
• Lantronix, "Vulnerability Library". https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/

8. Adverse Trace position

Adverse Trace assesses both CVEs as HIGH per the CISA-published CVSS scores (3.1 7.5, 4.0 7.7) and notes that neither has a CISA KEV entry and CISA reports no known public exploitation. The practical severity for a financial services client depends on whether G520 units sit in a path that matters: a gateway on a branch, ATM or remote-site link that an attacker can reach on the network is a root-level compromise waiting to happen, while an isolated unit behind strict segmentation is a lower priority. The signature-verification flaw is the one we would not close by patching alone, because the exposed production key stays trusted until Lantronix rotates it, and the source does not confirm that rotation has happened. All technical detail here is single-sourced to the CISA advisory; verify the firmware fix and the key-rotation status directly with Lantronix before treating the exposure as closed. Adverse Trace will monitor the Lantronix Vulnerability Library and CISA ICS advisories for a key-rotation confirmation or any change in exploitation status, and will reissue this advisory if either appears.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.