G520 Series
Monthly
Lantronix G520 Series firmware (2.6.0.4R6 stable, covering G526, G526RP, G527 and G528) can be induced to treat forged software packages as authentic, because the boot-time 'stock done' routine disables OPKG signature verification before restoring optional packages from a writable, unsigned feed, and because the production private key whose public counterpart is trusted by both stable and beta builds ships inside the publicly distributed Lantronix SDK. An attacker who can deliver a malicious package onto the device's update/feed path and get it processed can execute arbitrary code with root privileges at install time, although the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R) shows this is gated by attack requirements and passive user interaction rather than a one-shot unauthenticated remote compromise. No public exploit code, PoC, or confirmed in-the-wild exploitation was identified at the time of analysis, but the combination of an exposed trust anchor and a signature-verification bypass makes this a genuine high-impact integrity flaw rather than an inflated score.
Update metadata fetched over plain HTTP by Lantronix G520 series devices (reported against firmware 2.6.0.4R6 stable, covering G526, G526RP, G527 and G528 models) can be tampered with so that a stored value is later served by the management interface as JSON and rendered as raw HTML by the update-information web page, allowing attacker-controlled script to run in an authenticated administrator's browser. Because the same authenticated origin also exposes an interface that executes system-level commands with root privileges, an attacker who can inject metadata can escalate from script execution to arbitrary code execution in the device's administrative context. The vendor-assigned CVSS 4.0 base score is 7.7, but the attack is not opportunistic: it requires an on-path/adversary-in-the-middle position against the unencrypted update channel (AT:P) and an administrator who opens the affected page (UI:P), and no public exploit code or confirmed active exploitation was identified at time of analysis - the issue was reported through CISA's ICS coordination process (ICSA-26-272-01).
Lantronix G520 Series firmware (2.6.0.4R6 stable, covering G526, G526RP, G527 and G528) can be induced to treat forged software packages as authentic, because the boot-time 'stock done' routine disables OPKG signature verification before restoring optional packages from a writable, unsigned feed, and because the production private key whose public counterpart is trusted by both stable and beta builds ships inside the publicly distributed Lantronix SDK. An attacker who can deliver a malicious package onto the device's update/feed path and get it processed can execute arbitrary code with root privileges at install time, although the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R) shows this is gated by attack requirements and passive user interaction rather than a one-shot unauthenticated remote compromise. No public exploit code, PoC, or confirmed in-the-wild exploitation was identified at the time of analysis, but the combination of an exposed trust anchor and a signature-verification bypass makes this a genuine high-impact integrity flaw rather than an inflated score.
Update metadata fetched over plain HTTP by Lantronix G520 series devices (reported against firmware 2.6.0.4R6 stable, covering G526, G526RP, G527 and G528 models) can be tampered with so that a stored value is later served by the management interface as JSON and rendered as raw HTML by the update-information web page, allowing attacker-controlled script to run in an authenticated administrator's browser. Because the same authenticated origin also exposes an interface that executes system-level commands with root privileges, an attacker who can inject metadata can escalate from script execution to arbitrary code execution in the device's administrative context. The vendor-assigned CVSS 4.0 base score is 7.7, but the attack is not opportunistic: it requires an on-path/adversary-in-the-middle position against the unencrypted update channel (AT:P) and an administrator who opens the affected page (UI:P), and no public exploit code or confirmed active exploitation was identified at time of analysis - the issue was reported through CISA's ICS coordination process (ICSA-26-272-01).