Our takeCISA reports active exploitation of two flaws in Lantronix G520 Series Cellular Gateway 2.6.0.4R6_stable that let attackers replace software and run arbitrary code as root. Patch immediately if you run these OT gateways.Cyber Resilience desk
Sources (1)
- cisa_ics · cisa_ics
What this means for you — Security leader:CISA reports active exploitation of two vulnerabilities in Lantronix G520 Series Cellular Gateway v2.6.0.4R6_stable that allow arbitrary code execution as root. Patch or replace affected devices immediately.
What this means for you — Lean IT orgs:If you use a Lantronix G520 cellular gateway, check the firmware version and update to a fixed release or replace the device right away.
What this means for you — MSP:Audit client environments for any Lantronix G520 Series Cellular Gateway devices running version 2.6.0.4R6_stable and schedule immediate patching or replacement.
What this means for you — Researcher:CISA reports in-the-wild exploitation of CVE-2026-84409 and CVE-2026-91191 in Lantronix G520 Series Cellular Gateway before 2.6.0.4R6_stable; successful exploitation yields root-level arbitrary code execution.