An attacker can supply a malicious firmware or package that bypasses cryptographic signature verification, allowing arbitrary code to run with root privileges during installation. The device’s update routine temporarily disables signature checks, while an SDK distributed by the vendor contains the production private key, enabling an attacker to sign packages that the device will accept. This flaw results in remote code execution with full system privileges.

Lantronix G520 Series gateways, including the G520, G526, G526RP, G527, and G528 models, are impacted. The vulnerability is fixed in Lantronix release 2.6.0.7R6, which is available for download on the vendor’s website.

The CVSS score of 7.7 classifies this as a high‑severity issue. The EPSS score is currently unavailable, but the presence of a hard‑coded private key and an update path that accepts unsigned packages indicates that exploitation is plausible with moderate effort. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet, yet the attack vector (supplying a signed package or updating a device in the network) is feasible for an attacker with network access or supply‑chain compromise.