Lantronix cellular gateway turns tampered update metadata into root code, CISA says

The first path starts at the update fetch. The G520 pulls update metadata over an unencrypted HTTP connection and keeps parts of it ^[4]. A management interface later returns that stored value in a JSON response, and the page that displays update information writes it into the HTML unchanged, so metadata an attacker controls is treated as script ^[5]. CISA classes this as cross-site scripting, CWE-79 ^[7]. That script runs in the same authenticated origin that also exposes an interface for executing system commands as root, so the chain runs from injected metadata to arbitrary code in the device's administrative context ^[6]. Because the fetch is unencrypted, anyone who can rewrite that HTTP response on the wire can plant the payload.

The second path is about package trust. During boot, the stock done function turns off signature verification in the OPKG configuration, then restores optional packages from a writable, unsigned feed ^[8]. The publicly distributed SDK also contains the production private key, and the matching public key is trusted by both stable and beta firmware ^[9]. CISA says either issue alone undermines package authenticity, and that even if signature enforcement is restored, the exposed key still lets an attacker generate signatures the device will accept ^[10]. It labels this CWE-347 ^[12]. An attacker who can deliver a malicious package can run code as root during installation ^[11].

Both paths reach the outcome CISA states up front: replace software and run arbitrary code as root ^[1]. The affected build is 2.6.0.4R6_stable, tracked as CVE-2026-84409 and CVE-2026-91191 ^[2]. Where the firmware update cannot be applied at once, CISA's guidance is exposure control: keep the gateways off the internet, behind firewalls, and isolated from the business network ^[15].