Paper/Archive/CVE-2025-58083

CVE-2025-58083

General Industrial Controls Lynx+ Gateway — General Industrial Controls Lynx+ Gateway Missing Authentication for Critical Function

EPSS 0.6%CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 48.6.486 × 209.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device.

Affected

ProductAffectedFixed inSource

Lynx+ GatewayVersion R08–CNA

Lynx+ GatewayVersion V03–CNA

Lynx+ GatewayVersion V05–CNA

Lynx+ GatewayVersion V18–CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

icscert (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-25-317-08 refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-08.json