CVE-2025-59780

General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to send GET requests to obtain sensitive device information.

Score

CVSS 4.0 8.7 High

Status

Deferred - ics-cert@hq.dhs.gov

Published

2025-11-15

Last modified

2026-10-07

Weaknesses

CWE-306

Affected products

• Lynx Gateway (General Industrial Controls)

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-08
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-08.json