CISA Warns: Critical Lynx+ Gateway Flaw (CVSS 10.0) Allows Unauthenticated Remote Reset; Vendor Non-Responsive

According to CISA, the advisory details four high‑severity vulnerabilities affecting the Lynx+ Gateway manufactured by General Industrial Controls (GIC). The flaws include CVE-2025-55034 (CVSS 8.2) for weak password requirements, CVE-2025-58083 (CVSS 10.0) for missing authentication in the embedded web server that could allow a remote device reset, CVE-2025-59780 (CVSS 7.5) for missing authentication for sensitive data retrieval, and CVE-2025-62765 (CVSS 7.5) for cleartext transmission of sensitive information.

The affected versions are R08, V03, V05 and V18. The advisory states that successful exploitation could lead to unauthorized access, device resets, or exposure of sensitive information, including credentials. It also notes that the manufacturer did not respond to coordinated disclosure efforts, underscoring the urgency for organisations deploying Lynx+ gateways.