Lantronix G520 2.6.0.4R6 stable Update Mechanism improper authentication

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Lantronix G520 2.6.0.4R6 stable. Affected by this issue is some unknown functionality of the component Update Mechanism. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-91191. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Lantronix G520 2.6.0.4R6 stable. This issue affects an unknown functionality of the component Update Mechanism. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed. Separately, the publicly distributed SDK contains the production private key whose corresponding public key is trusted by both stable and beta firmware builds. Either issue undermines package authenticity, and together they allow an attacker to provide packages that appear valid to the system. Even if signature enforcement is restored, the exposed production key enables an attacker to generate signatures that the device will continue to trust. An attacker who can supply a malicious package may be able to execute arbitrary code with root privileges during installation.

The advisory is shared at ltrxdev.atlassian.net. The identification of this vulnerability is CVE-2026-91191 since 09/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/29/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Lantronix

Name

• G520

Version

• 2.6.0.4R6 stable

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion