Lantronix G520 Series Cellular Gateway

CVE-2026-84409CVE-2026-91191

September 29, 2026 · CISA (US-CERT) · Severity: CRITICAL

This CISA advisory describes two vulnerabilities in Lantronix G520 Series Cellular Gateways: an XSS flaw from unencrypted update metadata and a cryptographic signature verification issue. These flaws allow an attacker to execute arbitrary code with root privileges. The vendor has released firmware version 2.6.0.7R6 to address the issues. 📌 **Analyst Note:** Operators of Lantronix G520 gateways in critical infrastructure should upgrade to firmware 2.6.0.7R6 immediately, as the combination of XSS and command execution could allow attackers to fully compromise devices and pivot into sensitive networks.

Key Takeaways

Lantronix G520 Series Cellular Gateway firmware version 2.6.0.4R6_stable contains two vulnerabilities: a stored XSS via unencrypted update metadata and improper verification of cryptographic signatures.
An attacker who can influence update metadata can execute arbitrary code with root privileges by exploiting the XSS combined with a management interface that runs system-level commands.
Successful exploitation could allow an attacker to replace software and execute arbitrary code with root privileges, impacting critical infrastructure sectors like Transportation, Energy, and Water and Wastewater Systems.
An attacker who can influence update metadata can execute arbitrary code with root privileges by exploiting the XSS combined with a management interface that runs system-level commands.
Successful exploitation could allow an attacker to replace software and execute arbitrary code with root privileges, impacting critical infrastructure sectors like Transportation, Energy, and Water and Wastewater Systems.