Critical Vulnerabilities Affect Lantronix G520 Series Cellular Gateways

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-272-01 on September 29, 2026, warning of two critical vulnerabilities impacting the Lantronix G520 Series Cellular Gateway, a device commonly used in transportation systems, energy, and water and wastewater sectors worldwide.

The first vulnerability, CVE-2026-84409, has a CVSS v3 base score of 7.5 and a CVSS v4 base score of 7.7. It arises from the device's update mechanism retrieving metadata over unencrypted HTTP and subsequently inserting that stored value into web pages as HTML without proper sanitization. This cross-site scripting flaw, combined with an authenticated interface capable of executing system-level commands with root privileges, could allow an attacker who can influence update metadata to execute arbitrary code within the administrative context of the device.

The second vulnerability, CVE-2026-91191, also carries a CVSS v3 base score of 7.5 and a CVSS v4 base score of 7.7. It involves two interrelated issues: conditions that allow unauthorized software packages to be accepted as authentic during the boot process, and the inclusion of the production private key in the publicly distributed SDK. Together, these weaknesses undermine package authenticity, enabling an attacker to supply malicious packages that the device will trust, potentially leading to arbitrary code execution with root privileges during installation.

Lantronix has addressed the reported issues in firmware release version 2.6.0.7R6, which is available on the company's website. The vendor recommends that affected users upgrade to the patched firmware immediately. Additional mitigation information can be found through the Lantronix Vulnerability Library and by contacting Lantronix support.

Given the widespread deployment of these gateways in critical infrastructure sectors and the potential for remote code execution with root privileges, these vulnerabilities present a significant risk to operational technology environments.