GCVE-1988-2026-0426

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SGX5150",
          "vendor": "Lantronix",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Lantronix\nSGX5150, firmware 9.13.0.0R7, an IT/OT device server.\n\nType: authenticated OS command injection (CWE-78) in the FsBrowseClean AJAX\nhandler (0x5eea0) of /bin/ltrx_evo. A per-character filter blocks & | < ; ! $\nbackslash backtick and > but permits single quote, hash and newline. The path\nPOST parameter is concatenated into /sbin/ltrx_usb_umount '%s' and run through\n/bin/sh -c as root. Sending path=x'%0a<cmd>%20%23 closes the quoted argument,\nopens a new shell line carrying the attacker's command, and comments out the\ntrailing quote. The sink is blind.\n\nScoring. This finding is dual-scored, and the conditional figure is NOT\nverified, which is stated rather than glossed:\n- PRIMARY, adopted, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.\n  PR:H rests on a genuine privileged web session being required.\n- CONDITIONAL, NOT verified, 9.8 Critical,\n  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Applies only if the device\n  serial number is obtainable, which would make the factory administrator\n  password (recorded as serial-derived) no secret and the chain effectively\n  unauthenticated. Serial recovery was NOT verified, and neither was the\n  derivation itself.\n- SEPARATE secondary defect, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reachable only where Digest \nauthentication is configured: the\n  Digest username extractor at 0xff838 verifies no nonce, realm or response, so a\n  forged Authorization: Digest username=\"admin\" header alone sets the identity to\n  admin. This is independent of, and not additive to, the primary finding.\n\nScoring note. The research record attached 8.8 to the PR:H vector. That vector\ncomputes to 7.2, not 8.8 under CVSS 3.1; this advisory recomputes from the vector\nprinted beside it and reports 7.2, keeping 8.8 only as a labelled PR:L\nhypothetical (no lower-privileged account passing the filesystem write test was\nenumerated, so it is not claimed).\n\nImpact: root execution on an industrial gateway (ltrx_evo runs as root), giving\nfull read of configuration and serial traffic, arbitrary root modification,\npersistent implantation, total availability loss and a pivot into segmented\nnetworks.\n\nAuthentication: an authenticated web session satisfying\nIsGroupListWritable(identity, \"filesystem\"); the session precondition is static\nanalysis, not dynamically verified.\n\nVerification boundary, stated plainly. No physical SGX5150 hardware was used at\nany point; verification is sink-faithful rather than full-stack. The character\nfilter, the IseUSB gate and the sink construction were replicated in a chroot of\nthe extracted ARM rootfs under qemu-arm-static, and the injected newline vector\npassed the product's own filter and ran as root via the product's own /bin/sh and\nmarker owned by root:root. End-to-end HTTP against a live daemon was not\nachievable, because ltrx_evo requires NVRAM state, the encrypted factory.xcr\ndevice-serial material and a ZMQ IPC stack that could not be reconstructed\noutside the device.\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/lantronix-sgx5150-fsbrowseclean-command-injection\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nThe vendor has been notified through its published security contact. No vulnerability identifier has been assigned to\nthis finding yet.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/74"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/74"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/lantronix-sgx5150-fsbrowseclean-command-injection"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/74"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Lantronix SGX5150 9.13.0.0R7 Authenticated FsBrowseClean command injection to root RCE (7.2)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0426",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/74",
            "automated": true,
            "contentSha256": "d6670722639ae6e018f6457e300ad3ae04f054ec188213319fd7740f05872762",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/74",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T04:54:13Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0426"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}