CVE-2026-91191 Overview
CVE-2026-91191 is an improper signature verification flaw [CWE-347] affecting the update mechanism on Lantronix G520 Series devices (G526, G526RP, G527, G528). The device disables OPKG signature verification during boot via the stock_done function, then restores optional packages from a writable, unsigned feed. Compounding the issue, the publicly distributed SDK contains the production private key whose corresponding public key is trusted by both stable and beta firmware builds. An attacker who supplies a malicious package can execute arbitrary code with root privileges during installation.
Critical Impact
Attackers can install forged or malicious packages that the device accepts as authentic, resulting in arbitrary code execution as root on affected industrial gateways.
Affected Products
- Lantronix G520 Series (G526)
- Lantronix G526RP and G527
- Lantronix G528
Discovery Timeline
- 2026-09-29 - CVE CVE-2026-91191 published to NVD
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-91191
Vulnerability Analysis
The flaw combines two independent weaknesses that each defeat package authenticity guarantees on the affected Lantronix gateways. First, the stock_done function executed during boot modifies the OPKG configuration to disable signature verification before optional packages are restored from a writable, unsigned feed. Second, the vendor's publicly distributed Software Development Kit (SDK) ships with the production private key. That key corresponds to the public key trusted by both stable and beta firmware images. The result is that even when signature enforcement is later re-enabled, an attacker who obtained the SDK can generate valid signatures the device will trust indefinitely. OPKG (Open Package) is the lightweight package manager used across OpenWrt-derived embedded Linux firmware.
Root Cause
The root cause is a design failure in the firmware update trust chain [CWE-347]. The boot path programmatically weakens signature enforcement, and the code-signing private key is shipped inside a publicly distributed SDK. Either condition alone is sufficient to break package authenticity; together they eliminate all cryptographic guarantees that installed packages originated from Lantronix.
Attack Vector
An attacker with the ability to deliver a crafted package to the device, whether by staging it on the writable feed consumed at boot or by presenting it to the update mechanism over the network, can cause the OPKG installer to accept the payload. Because package installation executes maintainer scripts as root, the payload runs with full privileges during installation. The exposed SDK key allows the attacker to bypass signature checks even if the vendor restores enforcement. See the CISA ICS Advisory ICSA-26-272-01 and the CSAF advisory document for coordinated disclosure details.
No public proof-of-concept exploit code has been verified for this issue. See the referenced advisories for further technical description.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-91191
Indicators of Compromise
- Unexpected OPKG configuration files with option check_signature removed or commented out, particularly outside vendor-signed firmware images.
- New or modified packages appearing under /usr/lib/opkg/ or /overlay/ that were not sourced from an official Lantronix release.
- Unexpected outbound network traffic from G520 Series gateways to attacker-controlled package feed URLs.
- Root-owned processes or cron entries on the device that did not exist in the baseline firmware image.
Detection Strategies
- Compare running package manifests against a known-good baseline from the official Lantronix firmware release notes.
- Inspect stock_done execution artifacts and OPKG configuration state after boot to confirm signature verification is enforced.
- Monitor administrative access channels for uploads of .ipk package files or modifications to the OPKG feed configuration.
Monitoring Recommendations
- Forward device syslog and package management events to a centralized SIEM for correlation and long-term retention.
- Alert on any firmware or package installation activity occurring outside approved change windows.
- Track integrity of persistent partitions and generate alerts on unexpected writes to overlay or package directories.
How to Mitigate CVE-2026-91191
Immediate Actions Required
- Apply the latest firmware for the G520 Series (G526, G526RP, G527, G528) as documented in the Lantronix firmware update guidance.
- Restrict network access to management and package-feed interfaces on affected gateways using upstream firewall rules and network segmentation.
- Audit deployed devices for unauthorized packages and reflash from a trusted vendor image if tampering is suspected.
Patch Information
Lantronix has published updated firmware and coordinated disclosure through CISA. Refer to the Lantronix Vulnerability Library and CISA ICS Advisory ICSA-26-272-01 for the authoritative fixed versions and remediation steps. Note that because the production signing key was exposed in the SDK, a full remediation requires the vendor to rotate the signing key and re-issue firmware trust anchors.
Workarounds
- Block outbound access from affected gateways to any non-vendor package repositories at the network boundary.
- Disable or physically isolate the update mechanism on production gateways until patched firmware with rotated signing keys is deployed.
- Enforce administrative access to the device using strong authentication and restrict management to a dedicated out-of-band network.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
