Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature (CVE-2026-91191) | HOL Guard CVE

High · CVSS 7.7CVE-2026-91191

Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature

Answer in brief

CVE-2026-91191 records a High severity (CVSS 7.7) vulnerability in Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature. The current sources do not mark it as known exploited. The current feed maps Lantronix/G520 Series (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 29, 2026Updated Sep 29, 2026Source checked Sep 29, 2026First seen by HOL Sep 29, 2026Material review Sep 29, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.7
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

CVSS is 7.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Lantronix/G520 Series (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Lantronix/G520 Seriesgeneric	2.6.0.4R6 stable	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Lantronix/G520 Series.
Review the reported fix. Source-reported solution: Lantronix has addressed the reported issues with release version 2.6.0.7R6 which is available on their website. https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/1889828865/Latest+firmware+for+the+G520+Series+G526+G526RP+G527+G528 For more information, see the Lantronix Vulnerability Library. https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/ For more information or technical assistance, contact Lantronix support: [email protected] mailto:[email protected]

Evidence timeline and material changes

Published upstream
Sep 29, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 29, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 29, 2026

Sources and claim methodology

Upstream source description

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed. Separately, the publicly distributed SDK contains the production private key whose corresponding public key is trusted by both stable and beta firmware builds. Either issue undermines package authenticity, and together they allow an attacker to provide packages that appear valid to the system. Even if signature enforcement is restored, the exposed production key enables an attacker to generate signatures that the device will continue to trust. An attacker who can supply a malicious package may be able to execute arbitrary code with root privileges during installation.

Quoted source text, attributed separately from HOL analysis.