General Industrial Controls Lynx+ Gateway Missing Authentication Vulnerability in Embedded Web Server

A vulnerability exists in the General Industrial Controls Lynx+ Gateway due to critical authentication being absent in the embedded web server. This flaw could enable an attacker to send GET requests that retrieve sensitive device information. The issue is present in Lynx+ Gateway versions R08, V03, V05, and V18.

Impact

Exploitation of this vulnerability could lead to unauthorized access and the ability to obtain sensitive device information, according to CISA.

Remediation

General Industrial Controls (GIC) did not respond to CISA's attempts to coordinate. Users of General Industrial Controls Lynx+ Gateway are encouraged to reach out to GIC for more information.