CVE-2026-84409

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: ICS-CERT

Description

The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update information inserts that value directly into the page as HTML. This behavior allows attacker‑controlled metadata to be interpreted as script content. In addition, the same authenticated origin provides an interface capable of executing system‑level commands with root privileges. An attacker able to influence update metadata could exploit these conditions to execute arbitrary code within the administrative context of the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-84409

EUVD

EUVD-2026-89466

Affected Vendors & Products

Vendor	Product	Version / Range
Lantronix	G520	Series 2.6.0.4R6 stable

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability involves an insecure update mechanism that fetches software update metadata over unencrypted HTTP. The stored metadata is later inserted directly into HTML pages as script content, allowing attackers to inject malicious scripts. Additionally, a management interface can execute system-level commands with root privileges, enabling arbitrary code execution within the device's administrative context.

Detection Guidance

This vulnerability involves unencrypted HTTP metadata retrieval and potential arbitrary code execution via stored values in JSON responses. Detection requires inspecting network traffic for unencrypted update metadata requests and reviewing system logs for suspicious command execution patterns. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the device with administrative privileges. This could lead to unauthorized access, data theft, or complete system compromise. Users relying on this device for security or operations may face severe disruptions or breaches.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for sensitive health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Disable unencrypted HTTP metadata retrieval for software updates and switch to encrypted HTTPS. Inspect all update metadata for suspicious content before processing. Restrict access to the management interface and system-level command execution endpoints. Monitor network traffic for unauthorized update requests or metadata modifications.

Hi! I’m here to help you understand CVE-2026-84409. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70