CVE-2026-91191

Awaiting Analysis Awaiting Analysis - Queue

Unauthorized Package Execution in Firmware Update Mechanism

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: ICS-CERT

Description

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed. Separately, the publicly distributed SDK contains the production private key whose corresponding public key is trusted by both stable and beta firmware builds. Either issue undermines package authenticity, and together they allow an attacker to provide packages that appear valid to the system. Even if signature enforcement is restored, the exposed production key enables an attacker to generate signatures that the device will continue to trust. An attacker who can supply a malicious package may be able to execute arbitrary code with root privileges during installation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-91191

EUVD

EUVD-2026-89467

Affected Vendors & Products

Vendor	Product	Version / Range
lantronix	g520_series	to 2.6.0.7R6 (inc)
lantronix	g526	to 2.6.0.7R6 (inc)
lantronix	g526rp	to 2.6.0.7R6 (inc)
lantronix	g527	to 2.6.0.7R6 (inc)
lantronix	g528	to 2.6.0.7R6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability involves two issues in the device's update mechanism. First, during boot, the system disables signature verification before loading unsigned packages from a writable feed. Second, the publicly available SDK includes a production private key that the device trusts. Together, these flaws allow attackers to provide malicious packages that appear authentic, potentially leading to arbitrary code execution with root privileges.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized packages or modifications in the OPKG configuration. Inspect the boot process logs for disabled signature verification and review installed packages against known firmware checksums. Use commands like 'opkg list-installed' to compare packages, 'md5sum' to verify firmware files, and 'grep' to search for disabled signature checks in configuration files.

Impact Analysis

An attacker could exploit this to install malicious software on your device, gaining control with root privileges. This could lead to data theft, system compromise, or further network infiltration. Even if updates are applied, the exposed production key allows attackers to bypass security indefinitely.

Compliance Impact

This vulnerability undermines compliance with standards requiring software integrity and authenticity, such as GDPR's security principles and HIPAA's integrity safeguards. Unauthorized code execution risks data breaches and unauthorized access, violating confidentiality and integrity requirements.

Mitigation Strategies

Immediately disable the unsigned package feed in OPKG configuration and revoke the exposed production private key. Replace it with a new, secure key pair and ensure signature verification is enforced during boot and package installation. Review all installed packages for authenticity and remove any unauthorized ones.

Hi! I’m here to help you understand CVE-2026-91191. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70