Critical Flaws in General Industrial Controls Lynx+ Gateway Threaten Manufacturing Security (2025)
In November 2025, critical vulnerabilities were discovered in General Industrial Controls' Lynx+ Gateway devices deployed worldwide across the critical manufacturing sector. The exposed flaws—included weak password requirements, missing authentication for critical functions, and cleartext transmission of sensitive information—allowed attackers to remotely access devices, obtain sensitive information, and, in some cases, potentially cause denial-of-service conditions. Multiple CVEs (CVE-2025-55034, CVE-2025-58083, CVE-2025-59780, CVE-2025-62765) were assigned, with the highest CVSS v4 base score reaching 9.2. Despite coordinated disclosure efforts, the vendor did not respond, leaving organizations reliant on their own layered defense measures. This incident is highly relevant as it highlights persistent challenges in secure authentication and encrypted traffic within operational technology environments. The surge in attacks exploiting similar unauthenticated remote access and cleartext weaknesses continues to drive regulatory pressure for zero trust and encryption controls within industrial networks.
Kill Chain