CVE-2025-58083
published 2025-11-15CVE-2025-58083: General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the…
PriorityP270critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
0.63%
45.6th percentile
General Industrial Controls Lynx+ Gateway
is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| general_industrial_controls | lynx+_gateway | — | — |
| general_industrial_controls | lynx+_gateway | — | — |
| general_industrial_controls | lynx+_gateway | — | — |
| general_industrial_controls | lynx+_gateway | — | — |
| msrc | cbl2_kernel_5.15.176.3-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.180.1-1_on_cbl_mariner_2.0 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Missing authentication on the embedded web server of General Industrial Controls Lynx+ Gateway allows unauthenticated remote device reset — detect unauthenticated HTTP requests targeting the device's web server reset functionality from external/untrusted network segments ↗
- →Affected versions are R08, V03, V05, and V18 of the Lynx+ Gateway — fingerprint device version banners on the network to identify exposed instances ↗
- →CVE-2025-59780 (related, same device): unauthenticated GET requests to the embedded web server can leak sensitive device information — monitor for unauthenticated GET requests to the Lynx+ Gateway web interface from untrusted hosts ↗
- →CVE-2025-62765 (related, same device): credentials are transmitted in cleartext — monitor network traffic to/from Lynx+ Gateway for plaintext credential exposure (no TLS/HTTPS) ↗
- ·No patch is available; vendor (General Industrial Controls) did not respond to CISA coordination attempts — no fixed version to upgrade to at time of advisory publication ↗
- ·All four known affected firmware versions (R08, V03, V05, V18) are vulnerable; no version is confirmed safe — treat all deployed Lynx+ Gateways as unpatched ↗
- ·No known public exploitation reported at time of advisory, but the vulnerability is remotely exploitable with low attack complexity and no authentication required (CVSS v4 9.2) ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
General Industrial Controls Lynx+ Gateway
cisa_ics·2025-11-13·CVSS 8.2
[HIGH] General Industrial Controls Lynx+ Gateway
ICS Advisory
##
General Industrial Controls Lynx+ Gateway
Release DateNovember 13, 2025
Alert CodeICSA-25-317-08
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.2
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: General Industrial Controls
- Equipment: Lynx+ Gateway
- Vulnerabilities: Weak Password Requirements, Missing Authentication for Critical Function, Cleartext Transmission of Sensitive Information
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in obtaining sensitive device information, unauthorized access, or create a denial-of-service condition.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following
Microsoft
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
vendor_msrc·2025-03-11·CVSS 7.8
CVE-2024-58083 [HIGH] KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https:
GHSA
GHSA-gg5h-m9wx-57xr: General Industrial Controls Lynx+ Gateway
is missing critical authentication in the embedded web server which could allow an attacker to remotely rese
ghsa_unreviewed·2025-11-15
CVE-2025-58083 [CRITICAL] CWE-306 GHSA-gg5h-m9wx-57xr: General Industrial Controls Lynx+ Gateway
is missing critical authentication in the embedded web server which could allow an attacker to remotely rese
General Industrial Controls Lynx+ Gateway
is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-15
Published