CVE-2025-59780: Lynx+ Gateway Auth Bypass Vulnerability

CVE-2025-59780 Overview

CVE-2025-59780 is a missing authentication vulnerability in the General Industrial Controls Lynx+ Gateway embedded web server. The device exposes HTTP endpoints without enforcing authentication. Unauthenticated attackers can send GET requests to retrieve sensitive device information over the network. The flaw is tracked under CWE-306: Missing Authentication for Critical Function and was published in CISA ICS Advisory ICSA-25-317-08.

Critical Impact
Remote, unauthenticated attackers can harvest sensitive configuration and operational data from exposed Lynx+ Gateway devices, providing reconnaissance value for follow-on attacks against industrial control environments.

Affected Products

General Industrial Controls Lynx+ Gateway (embedded web server)
Industrial Control Systems (ICS) deployments using the Lynx+ Gateway
Operational Technology (OT) networks exposing the gateway to reachable network segments

Discovery Timeline

2025-11-15 - CVE-2025-59780 published to NVD and disclosed via CISA ICS Advisory ICSA-25-317-08
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-59780

Vulnerability Analysis

The Lynx+ Gateway exposes administrative and informational endpoints through an embedded web server. The server fails to require authentication before processing GET requests, meaning any network-reachable client can query the device. This is a classic missing authentication for critical function defect [CWE-306], where access control is absent rather than weak.

The vulnerability is reachable from the network without user interaction, privileges, or social engineering. An attacker only needs HTTP reachability to the gateway. Because Lynx+ Gateways are deployed in industrial environments, exposure may extend across flat OT segments that are not isolated from corporate networks.

Exploitation provides confidentiality impact only — data is disclosed, but the advisory does not describe write or control primitives via this specific issue. The disclosed information can support further attacks, including credential harvesting, network mapping, or pivoting to the underlying control protocols.

Root Cause

The embedded web server does not enforce authentication checks on its request handlers. Sensitive device endpoints process and return responses to any caller. The design omits an access control layer in front of the information disclosure endpoints.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker issues HTTP GET requests directly to the gateway's web server and receives device information in the response. No exploit code is required beyond standard HTTP tooling such as curl or a browser. No public proof-of-concept is referenced in the advisory, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified exploit code available.
// The vulnerability is triggered by issuing unauthenticated HTTP GET
// requests to the Lynx+ Gateway embedded web server. See CISA ICSA-25-317-08
// for vendor-provided technical details.

Detection Methods for CVE-2025-59780

Indicators of Compromise

Unauthenticated HTTP GET requests to Lynx+ Gateway management URLs from unexpected source addresses
Outbound responses from the gateway containing device configuration or identification data to non-engineering hosts
Repeated enumeration patterns (sequential paths, scanner User-Agent strings) directed at the gateway IP

Detection Strategies

Inspect network traffic for HTTP requests to the Lynx+ Gateway's web interface that do not carry an Authorization header or session cookie
Correlate access to the gateway with the approved engineering workstation inventory and alert on deviations
Deploy ICS-aware IDS signatures referencing CISA advisory ICSA-25-317-08

Monitoring Recommendations

Enable full packet capture or NetFlow on the OT segment hosting the gateway and retain logs for retrospective analysis
Monitor for scanning behavior from IT-to-OT boundary devices, including unusual HTTP request volumes
Track gateway availability and configuration drift to identify unauthorized interaction following information disclosure

How to Mitigate CVE-2025-59780

Immediate Actions Required

Remove the Lynx+ Gateway from any internet-exposed interface and confirm it is not reachable from untrusted networks
Place the device behind a firewall or industrial DMZ that restricts HTTP access to authorized engineering hosts only
Review web server access logs, where available, for prior unauthenticated GET activity

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Refer to CISA ICS Advisory ICSA-25-317-08 and the corresponding CSAF document for the latest vendor guidance and any released firmware updates.

Workarounds

Segment the Lynx+ Gateway onto an isolated OT VLAN with strict ingress filtering
Require VPN access with multi-factor authentication for any remote interaction with the gateway
Block inbound TCP/80 and TCP/443 to the gateway from all sources except a documented allowlist of engineering workstations
Apply CISA's defense-in-depth guidance for control system security, including network architecture review

bash

# Example ingress restriction on an upstream Linux firewall
# Replace <GATEWAY_IP> and <ENG_WORKSTATION_CIDR> with site values
iptables -A FORWARD -p tcp -s <ENG_WORKSTATION_CIDR> -d <GATEWAY_IP> --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d <GATEWAY_IP> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <GATEWAY_IP> --dport 443 -j DROP