Search
Find a vulnerability
Search criteria
14 vulnerabilities found for L-INX by Loytec
CVE-2026-55732 (GCVE-0-2026-55732)
Vulnerability from nvd – Published: 2026-07-24 14:00 – Updated: 2026-07-24 14:53
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)
Summary
Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.18
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55732",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:53:38.766440Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:53:49.184Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Out-of-bounds Read (CWE-125)\u0026nbsp;in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."
}
],
"value": "Out-of-bounds Read (CWE-125)\u00a0in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:00:48.771Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8532-dibt-cve-20260608-0001-bacnet-crash-due-to-invalid-timesync-message-high"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware version 8.4.20."
}
],
"value": "Upgrade to firmware version 8.4.20."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-55732",
"datePublished": "2026-07-24T14:00:48.771Z",
"dateReserved": "2026-06-17T09:48:05.268Z",
"dateUpdated": "2026-07-24T14:53:49.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55731 (GCVE-0-2026-55731)
Vulnerability from nvd – Published: 2026-07-24 14:00 – Updated: 2026-07-24 14:54
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent
Summary
Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-606 - Unchecked input for loop condition
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55731",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:54:22.819899Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:54:34.007Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unchecked input for loop condition (CWE-606)\u0026nbsp;in the SNMP agent in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component."
}
],
"value": "Unchecked input for loop condition (CWE-606)\u00a0in the SNMP agent in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "CWE-606 Unchecked input for loop condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:00:30.497Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8531-dibt-cve-20260601-0003-unchecked-input-for-loop-condition-cwe-606-in-the-snmp-agent-medium"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware version 8.4.18."
}
],
"value": "Upgrade to firmware version 8.4.18."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-55731",
"datePublished": "2026-07-24T14:00:30.497Z",
"dateReserved": "2026-06-17T09:48:05.268Z",
"dateUpdated": "2026-07-24T14:54:34.007Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55728 (GCVE-0-2026-55728)
Vulnerability from nvd – Published: 2026-07-24 13:58 – Updated: 2026-07-24 14:56
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict
Summary
Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based buffer overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55728",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:55:52.913648Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:56:40.020Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stack-based Buffer Overflow (CWE-121)\u0026nbsp;in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument."
}
],
"value": "Stack-based Buffer Overflow (CWE-121)\u00a0in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
},
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 3.8,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T13:58:35.474Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8523-dibt-cve-20260526-0005-stack-buffer-overflow-in-cmd_ipaddr_conflict-low"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware version 8.4.18."
}
],
"value": "Upgrade to firmware version 8.4.18."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-55728",
"datePublished": "2026-07-24T13:58:35.474Z",
"dateReserved": "2026-06-17T09:48:05.267Z",
"dateUpdated": "2026-07-24T14:56:40.020Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12504 (GCVE-0-2026-12504)
Vulnerability from nvd – Published: 2026-07-24 13:58 – Updated: 2026-07-24 14:57
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Improper Authentication in PAM configuration
Summary
Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12504",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:57:10.832151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:57:20.563Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Authentication (CWE-287)\u0026nbsp;in the PAM configuration in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field."
}
],
"value": "Improper Authentication (CWE-287)\u00a0in the PAM configuration in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
},
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-521",
"description": "CWE-521 Weak password requirements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T13:58:16.232Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8521-dibt-cve-20260526-0003-pam-passwordless-uid-0-authentication-high"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware version 8.4.18."
}
],
"value": "Upgrade to firmware version 8.4.18."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Improper Authentication in PAM configuration",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-12504",
"datePublished": "2026-07-24T13:58:16.232Z",
"dateReserved": "2026-06-17T09:48:17.638Z",
"dateUpdated": "2026-07-24T14:57:20.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12503 (GCVE-0-2026-12503)
Vulnerability from nvd – Published: 2026-07-24 13:57 – Updated: 2026-07-24 14:57
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter
Summary
Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-59 - Improper link resolution before file access ('link following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12503",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:57:37.633031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:57:47.202Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Link Resolution (CWE-59)\u0026nbsp;in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`."
}
],
"value": "Improper Link Resolution (CWE-59)\u00a0in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
},
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T13:57:56.691Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8520-dibt-cve-20260526-0002-symlink-following-in-chown-chmod-critical"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware 8.4.18."
}
],
"value": "Upgrade to firmware 8.4.18."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-12503",
"datePublished": "2026-07-24T13:57:56.691Z",
"dateReserved": "2026-06-17T09:48:11.206Z",
"dateUpdated": "2026-07-24T14:57:47.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12502 (GCVE-0-2026-12502)
Vulnerability from nvd – Published: 2026-07-24 13:57 – Updated: 2026-07-24 14:58
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo
Summary
Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-269 - Improper privilege management
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12502",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:58:09.849263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:58:22.991Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Privilege Management (CWE-269)\u0026nbsp;in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."
}
],
"value": "Improper Privilege Management (CWE-269)\u00a0in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
},
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper privilege management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T13:57:44.001Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-20260526-0001-unrestricted-service-account-password-reset-high"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware version 8.4.18."
}
],
"value": "Upgrade to firmware version 8.4.18."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-12502",
"datePublished": "2026-07-24T13:57:44.001Z",
"dateReserved": "2026-06-17T09:48:08.859Z",
"dateUpdated": "2026-07-24T14:58:22.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12496 (GCVE-0-2026-12496)
Vulnerability from nvd – Published: 2026-07-24 13:57 – Updated: 2026-07-24 15:01
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server
Summary
Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12496",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T15:01:05.617837Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T15:01:17.030Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored Cross-Site Scripting (CWE-79)\u0026nbsp;in the OPC XML-DA server statistics in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator\u0027s browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.\u003cbr\u003e"
}
],
"value": "Stored Cross-Site Scripting (CWE-79)\u00a0in the OPC XML-DA server statistics in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator\u0027s browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper encoding or escaping of output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T13:57:24.818Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8522-dibt-cve-20260526-0004-unauthenticated-stored-xxs-in-opc-xml-da-server-statistics-high"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware version 8.4.18."
}
],
"value": "Upgrade to firmware version 8.4.18."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-12496",
"datePublished": "2026-07-24T13:57:24.818Z",
"dateReserved": "2026-06-17T08:57:07.049Z",
"dateUpdated": "2026-07-24T15:01:17.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55732 (GCVE-0-2026-55732)
Vulnerability from cvelistv5 – Published: 2026-07-24 14:00 – Updated: 2026-07-24 14:53
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)
Summary
Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.18
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.18
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55732",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:53:38.766440Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:53:49.184Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Out-of-bounds Read (CWE-125)\u0026nbsp;in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."
}
],
"value": "Out-of-bounds Read (CWE-125)\u00a0in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:00:48.771Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8532-dibt-cve-20260608-0001-bacnet-crash-due-to-invalid-timesync-message-high"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware version 8.4.20."
}
],
"value": "Upgrade to firmware version 8.4.20."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-55732",
"datePublished": "2026-07-24T14:00:48.771Z",
"dateReserved": "2026-06-17T09:48:05.268Z",
"dateUpdated": "2026-07-24T14:53:49.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55731 (GCVE-0-2026-55731)
Vulnerability from cvelistv5 – Published: 2026-07-24 14:00 – Updated: 2026-07-24 14:54
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent
Summary
Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-606 - Unchecked input for loop condition
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55731",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:54:22.819899Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:54:34.007Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unchecked input for loop condition (CWE-606)\u0026nbsp;in the SNMP agent in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component."
}
],
"value": "Unchecked input for loop condition (CWE-606)\u00a0in the SNMP agent in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "CWE-606 Unchecked input for loop condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:00:30.497Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8531-dibt-cve-20260601-0003-unchecked-input-for-loop-condition-cwe-606-in-the-snmp-agent-medium"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware version 8.4.18."
}
],
"value": "Upgrade to firmware version 8.4.18."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-55731",
"datePublished": "2026-07-24T14:00:30.497Z",
"dateReserved": "2026-06-17T09:48:05.268Z",
"dateUpdated": "2026-07-24T14:54:34.007Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55728 (GCVE-0-2026-55728)
Vulnerability from cvelistv5 – Published: 2026-07-24 13:58 – Updated: 2026-07-24 14:56
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict
Summary
Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based buffer overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55728",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:55:52.913648Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:56:40.020Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stack-based Buffer Overflow (CWE-121)\u0026nbsp;in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument."
}
],
"value": "Stack-based Buffer Overflow (CWE-121)\u00a0in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
},
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 3.8,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T13:58:35.474Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8523-dibt-cve-20260526-0005-stack-buffer-overflow-in-cmd_ipaddr_conflict-low"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware version 8.4.18."
}
],
"value": "Upgrade to firmware version 8.4.18."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-55728",
"datePublished": "2026-07-24T13:58:35.474Z",
"dateReserved": "2026-06-17T09:48:05.267Z",
"dateUpdated": "2026-07-24T14:56:40.020Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12504 (GCVE-0-2026-12504)
Vulnerability from cvelistv5 – Published: 2026-07-24 13:58 – Updated: 2026-07-24 14:57
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Improper Authentication in PAM configuration
Summary
Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12504",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:57:10.832151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:57:20.563Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Authentication (CWE-287)\u0026nbsp;in the PAM configuration in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field."
}
],
"value": "Improper Authentication (CWE-287)\u00a0in the PAM configuration in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
},
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-521",
"description": "CWE-521 Weak password requirements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T13:58:16.232Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8521-dibt-cve-20260526-0003-pam-passwordless-uid-0-authentication-high"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware version 8.4.18."
}
],
"value": "Upgrade to firmware version 8.4.18."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Improper Authentication in PAM configuration",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-12504",
"datePublished": "2026-07-24T13:58:16.232Z",
"dateReserved": "2026-06-17T09:48:17.638Z",
"dateUpdated": "2026-07-24T14:57:20.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12503 (GCVE-0-2026-12503)
Vulnerability from cvelistv5 – Published: 2026-07-24 13:57 – Updated: 2026-07-24 14:57
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter
Summary
Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-59 - Improper link resolution before file access ('link following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12503",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:57:37.633031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:57:47.202Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Link Resolution (CWE-59)\u0026nbsp;in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`."
}
],
"value": "Improper Link Resolution (CWE-59)\u00a0in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
},
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T13:57:56.691Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8520-dibt-cve-20260526-0002-symlink-following-in-chown-chmod-critical"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware 8.4.18."
}
],
"value": "Upgrade to firmware 8.4.18."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-12503",
"datePublished": "2026-07-24T13:57:56.691Z",
"dateReserved": "2026-06-17T09:48:11.206Z",
"dateUpdated": "2026-07-24T14:57:47.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12502 (GCVE-0-2026-12502)
Vulnerability from cvelistv5 – Published: 2026-07-24 13:57 – Updated: 2026-07-24 14:58
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo
Summary
Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-269 - Improper privilege management
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12502",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T14:58:09.849263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:58:22.991Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Privilege Management (CWE-269)\u0026nbsp;in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."
}
],
"value": "Improper Privilege Management (CWE-269)\u00a0in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
},
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper privilege management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T13:57:44.001Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-20260526-0001-unrestricted-service-account-password-reset-high"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware version 8.4.18."
}
],
"value": "Upgrade to firmware version 8.4.18."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-12502",
"datePublished": "2026-07-24T13:57:44.001Z",
"dateReserved": "2026-06-17T09:48:08.859Z",
"dateUpdated": "2026-07-24T14:58:22.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12496 (GCVE-0-2026-12496)
Vulnerability from cvelistv5 – Published: 2026-07-24 13:57 – Updated: 2026-07-24 15:01
VLAI
EPSS
VEX
Title
Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server
Summary
Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.loytec.com/support/product-security/a… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Loytec | LIP-ME20xC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-INX |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-GATE |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-ROC |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-IOB |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-DALI |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-VIS |
Affected:
0 , ≤ 8.4.16
(custom)
|
|
| Loytec | L-PAD |
Affected:
0 , ≤ 8.4.16
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12496",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T15:01:05.617837Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T15:01:17.030Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LIP-ME20xC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-INX",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-GATE",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-ROC",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-IOB",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-DALI",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-VIS",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "L-PAD",
"vendor": "Loytec",
"versions": [
{
"lessThanOrEqual": "8.4.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger, armasuisse CYD Campus"
},
{
"lang": "en",
"type": "finder",
"value": "Damian Pfammatter, armasuisse CYD Campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored Cross-Site Scripting (CWE-79)\u0026nbsp;in the OPC XML-DA server statistics in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator\u0027s browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.\u003cbr\u003e"
}
],
"value": "Stored Cross-Site Scripting (CWE-79)\u00a0in the OPC XML-DA server statistics in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator\u0027s browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper encoding or escaping of output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T13:57:24.818Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.loytec.com/support/product-security/advisories/8522-dibt-cve-20260526-0004-unauthenticated-stored-xxs-in-opc-xml-da-server-statistics-high"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to firmware version 8.4.18."
}
],
"value": "Upgrade to firmware version 8.4.18."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-12496",
"datePublished": "2026-07-24T13:57:24.818Z",
"dateReserved": "2026-06-17T08:57:07.049Z",
"dateUpdated": "2026-07-24T15:01:17.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}