Lantronix G520 Series Cellular Gateway

This CISA advisory reports critical vulnerabilities in the Lantronix G520 Series Cellular Gateway (v2.6.0.4R6_stable) that allow attacker-controlled update metadata to trigger stored XSS and enable delivery of unauthenticated malicious packages due to disabled or undermined signature verification (including exposure of the production private key), potentially resulting in arbitrary code execution with root privileges on devices deployed in critical infrastructure.