The vulnerability lies in how the device’s update mechanism handles metadata retrieved over an unsecured HTTP connection. Portions of this metadata are stored and later returned via a JSON response, which the web interface inserts directly into an HTML page without filtering. This insecure handling allows attacker‑controlled metadata to be interpreted as script by the browser, resulting in cross‑site scripting that can ultimately lead to arbitrary code execution with root privileges. The flaw is a classic input validation weakness classified as CWE‑79, and if exploited it permits full administrative control of the device.

The affected hardware is the Lantronix G520 Series Cellular Gateway. While the exact firmware ranges are not detailed in the advisory, Lantronix has issued a patch in release version 2.6.0.7R6, and the update is available for download from their website.

This flaw has a CVSS score of 7.7, signifying high severity. The EPSS score is not available, so the likelihood of exploitation is unknown, but the attack requires the ability to influence update metadata, which likely means the attacker must have authenticated access to the device’s management interface. The user interface’s ability to execute system commands with root privileges amplifies the danger once the XSS is achieved. The vulnerability is not listed in the CISA KEV catalog, which does not preclude exploitation but indicates it has not yet been widely reported or exploited in the wild.