Lantronix G520 Series Cellular Gateway

What happened

A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update information inserts that value directly into the page as HTML. This behavior allows attacker‑controlled metadata to be interpreted as script content.

In addition, the same authenticated origin provides an interface capable of executing system‑level commands with root privileges. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed.

Separately, the publicly distributed SDK contains the production private key whose corresponding public key is trusted by both stable and beta firmware builds. Either issue undermines package authenticity, and together they allow an attacker to provide packages that appear valid to the system.

Key facts

• In addition, the same authenticated origin — provides: an interface capable of executing system‑level commands with root privileges
• Separately, the publicly distributed SDK — includes: the production private key whose corresponding public key is trusted by both stable and beta firmware builds