General Industrial Controls Lynx+ Gateway Missing Authentication Vulnerability Allowing Remote Device Reset

A vulnerability exists in the General Industrial Controls Lynx+ Gateway due to missing critical authentication in the embedded web server. This flaw could enable an attacker to remotely reset the device. The vulnerability is present in Lynx+ Gateway versions R08, V03, V05, and V18.

Impact

Exploitation of this vulnerability could lead to unauthorized remote resets of the device, potentially causing a denial-of-service condition by disrupting normal operations.

Remediation

General Industrial Controls (GIC) did not respond to CISA's attempts to coordinate. Users of General Industrial Controls Lynx+ Gateway are encouraged to reach out to GIC for more information.