How update metadata reaches the administrative interface

CISA identifies Lantronix G520 Series Cellular Gateway version 2.6.0.4R6_stable as affected by the vulnerabilities. Its description of CVE-2026-84409 starts with the update process: the gateway obtains software update metadata through an HTTP connection without encryption and retains some of that information for subsequent use. That stored metadata becomes relevant when the device displays update information.

According to CISA, the management interface returns the retained value in JSON, after which the web interface places it into the page as HTML. Attacker-controlled metadata can consequently be treated as script content. CISA also describes an interface on the same authenticated origin that can run system commands with root privileges. The agency says an attacker who can influence the metadata could execute code in the device’s administrative context.

Why package authentication can fail

For CVE-2026-91191, CISA describes conditions that let unauthorized packages pass as authentic. During startup, the stock done function turns off signature checks in the OPKG configuration before optional packages are restored from a writable feed without signatures. Separately, CISA says the publicly distributed software development kit contains a production private key. Its matching public key is trusted by stable and beta firmware.

CISA explains that each issue weakens package authenticity. Restoring signature enforcement would still leave the exposed key usable for producing signatures the device accepts. The agency says an attacker able to supply a malicious package may obtain code execution with root privileges during installation. That outcome remains conditional on the attacker being able to provide the package.

What CISA recommends and what the account establishes

CISA recommends reducing network exposure and keeping control systems inaccessible from the internet. It advises placing control networks and remote devices behind firewalls, separating them from business networks, and using methods such as VPNs when remote access is necessary. The agency cautions that VPNs can have vulnerabilities, need updates and depend on connected-device security. It also calls for impact analysis and risk assessment before defensive measures are deployed.

This explainer relies on a single source, the supplied CISA material, without independent corroboration. CISA lists September 29, 2026 as the advisory’s initial release date; this is not a study publication date. At the time of that account, CISA said it had received no reports of known public exploitation specifically targeting these vulnerabilities. That reporting qualification does not establish that exploitation has never occurred.

Sources & context

  1. Lantronix G520 Series Cellular Gateway | CISACISA

    Single-source report; claims attributed to the source, not independently verified. The article relies solely on supplied CISA material and includes no independent corroboration. CISA’s statement about exploitation is limited to known public exploitation reported to the agency at the time of its account. News date: 2026-09-29T12:00:00.000Z. Study date: not established. Consulted: 2026-09-30T14:00:03.115Z.

AI assisted with preparing and checking this article. The responsible editor accepted this version for publication following an assisted review of facts, sources and attribution.

Related reading