G520 series vulnerabilities
6 known vulnerabilities in G520 series from Lantronix. 6 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
G520 Series: Improper Verification of Cryptographic Signature
The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packag
- 7.5 High severity
G520 Series: Improper Neutralization of Input During Web Page Generation
The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interfac
- 9.8 Critical severity
Lantronix EDS5000 Code Injection Exploited
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject
- 7.2 High severity
EDS5000 series: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges.
- 7.2 High severity
EDS5000 series: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are exe
- 7.2 High severity
EDS5000 series: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.