Search

Find a vulnerability

Search criteria

    14 vulnerabilities found for L-INX by Loytec

    CVE-2026-55732 (GCVE-0-2026-55732)

    Vulnerability from nvd – Published: 2026-07-24 14:00 – Updated: 2026-07-24 14:53
    VLAI
    Title
    Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)
    Summary
    Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55732",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:53:38.766440Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:53:49.184Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Out-of-bounds Read (CWE-125)\u0026nbsp;in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."
                }
              ],
              "value": "Out-of-bounds Read (CWE-125)\u00a0in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-540",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-540 Overread Buffers"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-125",
                  "description": "CWE-125 Out-of-bounds read",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T14:00:48.771Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8532-dibt-cve-20260608-0001-bacnet-crash-due-to-invalid-timesync-message-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.20."
                }
              ],
              "value": "Upgrade to firmware version 8.4.20."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-55732",
        "datePublished": "2026-07-24T14:00:48.771Z",
        "dateReserved": "2026-06-17T09:48:05.268Z",
        "dateUpdated": "2026-07-24T14:53:49.184Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-55731 (GCVE-0-2026-55731)

    Vulnerability from nvd – Published: 2026-07-24 14:00 – Updated: 2026-07-24 14:54
    VLAI
    Title
    Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent
    Summary
    Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-606 - Unchecked input for loop condition
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55731",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:54:22.819899Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:54:34.007Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Unchecked input for loop condition (CWE-606)\u0026nbsp;in the SNMP agent in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component."
                }
              ],
              "value": "Unchecked input for loop condition (CWE-606)\u00a0in the SNMP agent in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 6.6,
                "baseSeverity": "MEDIUM",
                "exploitMaturity": "UNREPORTED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-606",
                  "description": "CWE-606 Unchecked input for loop condition",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T14:00:30.497Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8531-dibt-cve-20260601-0003-unchecked-input-for-loop-condition-cwe-606-in-the-snmp-agent-medium"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-55731",
        "datePublished": "2026-07-24T14:00:30.497Z",
        "dateReserved": "2026-06-17T09:48:05.268Z",
        "dateUpdated": "2026-07-24T14:54:34.007Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-55728 (GCVE-0-2026-55728)

    Vulnerability from nvd – Published: 2026-07-24 13:58 – Updated: 2026-07-24 14:56
    VLAI
    Title
    Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict
    Summary
    Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-121 - Stack-based buffer overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55728",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:55:52.913648Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:56:40.020Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Stack-based Buffer Overflow (CWE-121)\u0026nbsp;in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in  Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument."
                }
              ],
              "value": "Stack-based Buffer Overflow (CWE-121)\u00a0in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in  Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-100",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-100 Overflow Buffers"
                }
              ]
            },
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "baseScore": 3.8,
                "baseSeverity": "LOW",
                "exploitMaturity": "UNREPORTED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-121",
                  "description": "CWE-121 Stack-based buffer overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:58:35.474Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8523-dibt-cve-20260526-0005-stack-buffer-overflow-in-cmd_ipaddr_conflict-low"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-55728",
        "datePublished": "2026-07-24T13:58:35.474Z",
        "dateReserved": "2026-06-17T09:48:05.267Z",
        "dateUpdated": "2026-07-24T14:56:40.020Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12504 (GCVE-0-2026-12504)

    Vulnerability from nvd – Published: 2026-07-24 13:58 – Updated: 2026-07-24 14:57
    VLAI
    Title
    Loytec LINX firmware: Improper Authentication in PAM configuration
    Summary
    Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-287 - Improper authentication
    • CWE-521 - Weak password requirements
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12504",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:57:10.832151Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:57:20.563Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Authentication (CWE-287)\u0026nbsp;in the PAM configuration in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field."
                }
              ],
              "value": "Improper Authentication (CWE-287)\u00a0in the PAM configuration in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-115",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-115 Authentication Bypass"
                }
              ]
            },
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-287",
                  "description": "CWE-287 Improper authentication",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-521",
                  "description": "CWE-521 Weak password requirements",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:58:16.232Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8521-dibt-cve-20260526-0003-pam-passwordless-uid-0-authentication-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Improper Authentication in PAM configuration",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12504",
        "datePublished": "2026-07-24T13:58:16.232Z",
        "dateReserved": "2026-06-17T09:48:17.638Z",
        "dateUpdated": "2026-07-24T14:57:20.563Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12503 (GCVE-0-2026-12503)

    Vulnerability from nvd – Published: 2026-07-24 13:57 – Updated: 2026-07-24 14:57
    VLAI
    Title
    Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter
    Summary
    Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-59 - Improper link resolution before file access ('link following')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12503",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:57:37.633031Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:57:47.202Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Link Resolution (CWE-59)\u0026nbsp;in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`."
                }
              ],
              "value": "Improper Link Resolution (CWE-59)\u00a0in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            },
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 9.2,
                "baseSeverity": "CRITICAL",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-59",
                  "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:57:56.691Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8520-dibt-cve-20260526-0002-symlink-following-in-chown-chmod-critical"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware 8.4.18."
                }
              ],
              "value": "Upgrade to firmware 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12503",
        "datePublished": "2026-07-24T13:57:56.691Z",
        "dateReserved": "2026-06-17T09:48:11.206Z",
        "dateUpdated": "2026-07-24T14:57:47.202Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12502 (GCVE-0-2026-12502)

    Vulnerability from nvd – Published: 2026-07-24 13:57 – Updated: 2026-07-24 14:58
    VLAI
    Title
    Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo
    Summary
    Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-269 - Improper privilege management
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12502",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:58:09.849263Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:58:22.991Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Privilege Management (CWE-269)\u0026nbsp;in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."
                }
              ],
              "value": "Improper Privilege Management (CWE-269)\u00a0in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            },
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-269",
                  "description": "CWE-269 Improper privilege management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:57:44.001Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-20260526-0001-unrestricted-service-account-password-reset-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12502",
        "datePublished": "2026-07-24T13:57:44.001Z",
        "dateReserved": "2026-06-17T09:48:08.859Z",
        "dateUpdated": "2026-07-24T14:58:22.991Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12496 (GCVE-0-2026-12496)

    Vulnerability from nvd – Published: 2026-07-24 13:57 – Updated: 2026-07-24 15:01
    VLAI
    Title
    Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server
    Summary
    Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
    • CWE-116 - Improper encoding or escaping of output
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12496",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T15:01:05.617837Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T15:01:17.030Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Stored Cross-Site Scripting (CWE-79)\u0026nbsp;in the OPC XML-DA server statistics in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator\u0027s browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.\u003cbr\u003e"
                }
              ],
              "value": "Stored Cross-Site Scripting (CWE-79)\u00a0in the OPC XML-DA server statistics in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator\u0027s browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-592",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-592 Stored XSS"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-116",
                  "description": "CWE-116 Improper encoding or escaping of output",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:57:24.818Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8522-dibt-cve-20260526-0004-unauthenticated-stored-xxs-in-opc-xml-da-server-statistics-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12496",
        "datePublished": "2026-07-24T13:57:24.818Z",
        "dateReserved": "2026-06-17T08:57:07.049Z",
        "dateUpdated": "2026-07-24T15:01:17.030Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-55732 (GCVE-0-2026-55732)

    Vulnerability from cvelistv5 – Published: 2026-07-24 14:00 – Updated: 2026-07-24 14:53
    VLAI
    Title
    Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)
    Summary
    Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55732",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:53:38.766440Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:53:49.184Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Out-of-bounds Read (CWE-125)\u0026nbsp;in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."
                }
              ],
              "value": "Out-of-bounds Read (CWE-125)\u00a0in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-540",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-540 Overread Buffers"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-125",
                  "description": "CWE-125 Out-of-bounds read",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T14:00:48.771Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8532-dibt-cve-20260608-0001-bacnet-crash-due-to-invalid-timesync-message-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.20."
                }
              ],
              "value": "Upgrade to firmware version 8.4.20."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-55732",
        "datePublished": "2026-07-24T14:00:48.771Z",
        "dateReserved": "2026-06-17T09:48:05.268Z",
        "dateUpdated": "2026-07-24T14:53:49.184Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-55731 (GCVE-0-2026-55731)

    Vulnerability from cvelistv5 – Published: 2026-07-24 14:00 – Updated: 2026-07-24 14:54
    VLAI
    Title
    Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent
    Summary
    Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-606 - Unchecked input for loop condition
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55731",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:54:22.819899Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:54:34.007Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Unchecked input for loop condition (CWE-606)\u0026nbsp;in the SNMP agent in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component."
                }
              ],
              "value": "Unchecked input for loop condition (CWE-606)\u00a0in the SNMP agent in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 6.6,
                "baseSeverity": "MEDIUM",
                "exploitMaturity": "UNREPORTED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-606",
                  "description": "CWE-606 Unchecked input for loop condition",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T14:00:30.497Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8531-dibt-cve-20260601-0003-unchecked-input-for-loop-condition-cwe-606-in-the-snmp-agent-medium"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-55731",
        "datePublished": "2026-07-24T14:00:30.497Z",
        "dateReserved": "2026-06-17T09:48:05.268Z",
        "dateUpdated": "2026-07-24T14:54:34.007Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-55728 (GCVE-0-2026-55728)

    Vulnerability from cvelistv5 – Published: 2026-07-24 13:58 – Updated: 2026-07-24 14:56
    VLAI
    Title
    Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict
    Summary
    Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-121 - Stack-based buffer overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55728",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:55:52.913648Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:56:40.020Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Stack-based Buffer Overflow (CWE-121)\u0026nbsp;in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in  Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument."
                }
              ],
              "value": "Stack-based Buffer Overflow (CWE-121)\u00a0in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in  Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-100",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-100 Overflow Buffers"
                }
              ]
            },
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "baseScore": 3.8,
                "baseSeverity": "LOW",
                "exploitMaturity": "UNREPORTED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-121",
                  "description": "CWE-121 Stack-based buffer overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:58:35.474Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8523-dibt-cve-20260526-0005-stack-buffer-overflow-in-cmd_ipaddr_conflict-low"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-55728",
        "datePublished": "2026-07-24T13:58:35.474Z",
        "dateReserved": "2026-06-17T09:48:05.267Z",
        "dateUpdated": "2026-07-24T14:56:40.020Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12504 (GCVE-0-2026-12504)

    Vulnerability from cvelistv5 – Published: 2026-07-24 13:58 – Updated: 2026-07-24 14:57
    VLAI
    Title
    Loytec LINX firmware: Improper Authentication in PAM configuration
    Summary
    Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-287 - Improper authentication
    • CWE-521 - Weak password requirements
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12504",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:57:10.832151Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:57:20.563Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Authentication (CWE-287)\u0026nbsp;in the PAM configuration in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field."
                }
              ],
              "value": "Improper Authentication (CWE-287)\u00a0in the PAM configuration in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-115",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-115 Authentication Bypass"
                }
              ]
            },
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-287",
                  "description": "CWE-287 Improper authentication",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-521",
                  "description": "CWE-521 Weak password requirements",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:58:16.232Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8521-dibt-cve-20260526-0003-pam-passwordless-uid-0-authentication-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Improper Authentication in PAM configuration",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12504",
        "datePublished": "2026-07-24T13:58:16.232Z",
        "dateReserved": "2026-06-17T09:48:17.638Z",
        "dateUpdated": "2026-07-24T14:57:20.563Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12503 (GCVE-0-2026-12503)

    Vulnerability from cvelistv5 – Published: 2026-07-24 13:57 – Updated: 2026-07-24 14:57
    VLAI
    Title
    Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter
    Summary
    Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-59 - Improper link resolution before file access ('link following')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12503",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:57:37.633031Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:57:47.202Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Link Resolution (CWE-59)\u0026nbsp;in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`."
                }
              ],
              "value": "Improper Link Resolution (CWE-59)\u00a0in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            },
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 9.2,
                "baseSeverity": "CRITICAL",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-59",
                  "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:57:56.691Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8520-dibt-cve-20260526-0002-symlink-following-in-chown-chmod-critical"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware 8.4.18."
                }
              ],
              "value": "Upgrade to firmware 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12503",
        "datePublished": "2026-07-24T13:57:56.691Z",
        "dateReserved": "2026-06-17T09:48:11.206Z",
        "dateUpdated": "2026-07-24T14:57:47.202Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12502 (GCVE-0-2026-12502)

    Vulnerability from cvelistv5 – Published: 2026-07-24 13:57 – Updated: 2026-07-24 14:58
    VLAI
    Title
    Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo
    Summary
    Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-269 - Improper privilege management
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12502",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:58:09.849263Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:58:22.991Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Privilege Management (CWE-269)\u0026nbsp;in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."
                }
              ],
              "value": "Improper Privilege Management (CWE-269)\u00a0in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            },
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-269",
                  "description": "CWE-269 Improper privilege management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:57:44.001Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-20260526-0001-unrestricted-service-account-password-reset-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12502",
        "datePublished": "2026-07-24T13:57:44.001Z",
        "dateReserved": "2026-06-17T09:48:08.859Z",
        "dateUpdated": "2026-07-24T14:58:22.991Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12496 (GCVE-0-2026-12496)

    Vulnerability from cvelistv5 – Published: 2026-07-24 13:57 – Updated: 2026-07-24 15:01
    VLAI
    Title
    Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server
    Summary
    Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
    • CWE-116 - Improper encoding or escaping of output
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12496",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T15:01:05.617837Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T15:01:17.030Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Stored Cross-Site Scripting (CWE-79)\u0026nbsp;in the OPC XML-DA server statistics in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator\u0027s browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.\u003cbr\u003e"
                }
              ],
              "value": "Stored Cross-Site Scripting (CWE-79)\u00a0in the OPC XML-DA server statistics in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator\u0027s browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-592",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-592 Stored XSS"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-116",
                  "description": "CWE-116 Improper encoding or escaping of output",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:57:24.818Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8522-dibt-cve-20260526-0004-unauthenticated-stored-xxs-in-opc-xml-da-server-statistics-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12496",
        "datePublished": "2026-07-24T13:57:24.818Z",
        "dateReserved": "2026-06-17T08:57:07.049Z",
        "dateUpdated": "2026-07-24T15:01:17.030Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }