Critical Vulnerabilities in Lantronix G520 Series Cellular Gateway

Lantronix G520 Series Cellular Gateway firmware version 2.6.0.4R6_stable contains two critical vulnerabilities that expose devices to full remote compromise. CVE-2026-84409 relates to an insecure update mechanism that fetches metadata over unencrypted HTTP, which is subsequently rendered in a web interface without proper neutralization, leading to Cross-Site Scripting (XSS). An attacker can leverage this to execute arbitrary commands as root within the administrative context.

Additionally, CVE-2026-91191 allows for the installation of malicious software packages due to improper signature verification and the inclusion of production private keys within the public SDK. By exploiting these flaws, an attacker can bypass package integrity checks and deploy arbitrary, malicious code with root-level access during the device boot or update process. These vulnerabilities pose significant risks to critical infrastructure sectors, including energy, water, and transportation, where such gateways are deployed.

Impact

Successful exploitation could result in complete loss of device control, persistent access for attackers, and the ability to pivot into sensitive operational networks. As these devices are typically deployed at the edge of industrial networks, compromise could lead to operational disruption, data exfiltration, or the unauthorized manipulation of industrial control processes. There are no reported cases of active exploitation in the wild as of the date of publication.

Recommendation

Prioritized actions for security operations and IT teams:

• Upgrade all instances of Lantronix G520 Series Cellular Gateways to firmware version 2.6.0.7R6 immediately to remediate both CVE-2026-84409 and CVE-2026-91191.
• Isolate cellular gateways from the public internet using firewalls; ensure that management interfaces are only accessible via secure, authenticated VPN tunnels.
• Implement egress traffic monitoring for gateway management traffic to identify connections to untrusted or unauthorized update servers.
• Disable unneeded services on gateway devices to reduce the attack surface.