EUVD-2026-89467
GHSA-q7r9-65j5-94xj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable update path but attacker must deliver a package and have it installed (AC:H, UI:R); no auth needed given disabled verification/leaked key (PR:N); root install yields full C:H/I:H/A:H.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
7DescriptionCVE.org
The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed. Separately, the publicly distributed SDK contains the production private key whose corresponding public key is trusted by both stable and beta firmware builds. Either issue undermines package authenticity, and together they allow an attacker to provide packages that appear valid to the system. Even if signature enforcement is restored, the exposed production key enables an attacker to generate signatures that the device will continue to trust. An attacker who can supply a malicious package may be able to execute arbitrary code with root privileges during installation.
AnalysisAI
Lantronix G520 Series firmware (2.6.0.4R6 stable, covering G526, G526RP, G527 and G528) can be induced to treat forged software packages as authentic, because the boot-time 'stock done' routine disables OPKG signature verification before restoring optional packages from a writable, unsigned feed, and because the production private key whose public counterpart is trusted by both stable and beta builds ships inside the publicly distributed Lantronix SDK. An attacker who can deliver a malicious package onto the device's update/feed path and get it processed can execute arbitrary code with root privileges at install time, although the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R) shows this is gated by attack requirements and passive user interaction rather than a one-shot unauthenticated remote compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires supplying a malicious OPKG package to the device's package feed and having it installed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-impact integrity flaw rather than an inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update G520 Series devices (G526, G526RP, G527, G528) to the fixed firmware published on Lantronix's latest-firmware page (https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/1889828865/Latest+firmware+for+the+G520+Series+G526+G526RP+G527+G528) and cross-check the Lantronix vulnerability library (https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/) and CISA ICSA-26-272-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-01); the provided data does not state an explicit patched version string, so confirm the exact fixed release with the vendor before assuming 2.6.0.4R6 or any specific build is remediated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Treat all Lantronix G520 Series devices (G526, G526RP, G527, G528) running firmware 2.6.0.4R6 stable or beta as exposed because No vendor-released patch identified at time of analysis; within 24 hours inventory every affected device, confirm whether remote update/feed paths are reachable, immediately restrict those paths to trusted management networks, block untrusted writes to package feeds, and disable or tightly control automatic optional-package restore and remote upgrade functions until Lantronix provides a fix. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a d
Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND_V1_12
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows r
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operatin
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows r
Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wirele
Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 wit
Poisoned-pipeline (pwn request) code execution in the Meshtastic firmware repository's GitHub Actions CI allows any exte
Authentication bypass in Tenda router firmware (AC10, AC5, AC6, FH1201, W15E) lets any user log in as administrator via
Anonymous MQTT access in Yarbo firmware v2.3.9 allows remote unauthenticated attackers on the local network to fully con
Hardcoded administrative credentials in Yarbo firmware v2.3.9 allow remote unauthenticated attackers to gain full device
Update metadata fetched over plain HTTP by Lantronix G520 series devices (reported against firmware 2.6.0.4R6 stable, co
Share
External POC / Exploit Code
Leaving vuln.today