Search

Find a vulnerability

Search criteria Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    14 vulnerabilities found for L-ROC by Loytec

    CVE-2026-55732 (GCVE-0-2026-55732)

    Vulnerability from nvd – Published: 2026-07-24 14:00 – Updated: 2026-07-24 14:53
    VLAI
    Title
    Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)
    Summary
    Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55732",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:53:38.766440Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:53:49.184Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Out-of-bounds Read (CWE-125)\u0026nbsp;in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."
                }
              ],
              "value": "Out-of-bounds Read (CWE-125)\u00a0in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-540",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-540 Overread Buffers"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-125",
                  "description": "CWE-125 Out-of-bounds read",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T14:00:48.771Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8532-dibt-cve-20260608-0001-bacnet-crash-due-to-invalid-timesync-message-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.20."
                }
              ],
              "value": "Upgrade to firmware version 8.4.20."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-55732",
        "datePublished": "2026-07-24T14:00:48.771Z",
        "dateReserved": "2026-06-17T09:48:05.268Z",
        "dateUpdated": "2026-07-24T14:53:49.184Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-55731 (GCVE-0-2026-55731)

    Vulnerability from nvd – Published: 2026-07-24 14:00 – Updated: 2026-07-24 14:54
    VLAI
    Title
    Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent
    Summary
    Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-606 - Unchecked input for loop condition
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55731",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:54:22.819899Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:54:34.007Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Unchecked input for loop condition (CWE-606)\u0026nbsp;in the SNMP agent in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component."
                }
              ],
              "value": "Unchecked input for loop condition (CWE-606)\u00a0in the SNMP agent in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 6.6,
                "baseSeverity": "MEDIUM",
                "exploitMaturity": "UNREPORTED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-606",
                  "description": "CWE-606 Unchecked input for loop condition",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T14:00:30.497Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8531-dibt-cve-20260601-0003-unchecked-input-for-loop-condition-cwe-606-in-the-snmp-agent-medium"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-55731",
        "datePublished": "2026-07-24T14:00:30.497Z",
        "dateReserved": "2026-06-17T09:48:05.268Z",
        "dateUpdated": "2026-07-24T14:54:34.007Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-55728 (GCVE-0-2026-55728)

    Vulnerability from nvd – Published: 2026-07-24 13:58 – Updated: 2026-07-24 14:56
    VLAI
    Title
    Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict
    Summary
    Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-121 - Stack-based buffer overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55728",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:55:52.913648Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:56:40.020Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Stack-based Buffer Overflow (CWE-121)\u0026nbsp;in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in  Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument."
                }
              ],
              "value": "Stack-based Buffer Overflow (CWE-121)\u00a0in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in  Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-100",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-100 Overflow Buffers"
                }
              ]
            },
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "baseScore": 3.8,
                "baseSeverity": "LOW",
                "exploitMaturity": "UNREPORTED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-121",
                  "description": "CWE-121 Stack-based buffer overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:58:35.474Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8523-dibt-cve-20260526-0005-stack-buffer-overflow-in-cmd_ipaddr_conflict-low"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-55728",
        "datePublished": "2026-07-24T13:58:35.474Z",
        "dateReserved": "2026-06-17T09:48:05.267Z",
        "dateUpdated": "2026-07-24T14:56:40.020Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12504 (GCVE-0-2026-12504)

    Vulnerability from nvd – Published: 2026-07-24 13:58 – Updated: 2026-07-24 14:57
    VLAI
    Title
    Loytec LINX firmware: Improper Authentication in PAM configuration
    Summary
    Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-287 - Improper authentication
    • CWE-521 - Weak password requirements
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12504",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:57:10.832151Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:57:20.563Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Authentication (CWE-287)\u0026nbsp;in the PAM configuration in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field."
                }
              ],
              "value": "Improper Authentication (CWE-287)\u00a0in the PAM configuration in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-115",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-115 Authentication Bypass"
                }
              ]
            },
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-287",
                  "description": "CWE-287 Improper authentication",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-521",
                  "description": "CWE-521 Weak password requirements",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:58:16.232Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8521-dibt-cve-20260526-0003-pam-passwordless-uid-0-authentication-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Improper Authentication in PAM configuration",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12504",
        "datePublished": "2026-07-24T13:58:16.232Z",
        "dateReserved": "2026-06-17T09:48:17.638Z",
        "dateUpdated": "2026-07-24T14:57:20.563Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12503 (GCVE-0-2026-12503)

    Vulnerability from nvd – Published: 2026-07-24 13:57 – Updated: 2026-07-24 14:57
    VLAI
    Title
    Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter
    Summary
    Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-59 - Improper link resolution before file access ('link following')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12503",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:57:37.633031Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:57:47.202Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Link Resolution (CWE-59)\u0026nbsp;in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`."
                }
              ],
              "value": "Improper Link Resolution (CWE-59)\u00a0in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            },
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 9.2,
                "baseSeverity": "CRITICAL",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-59",
                  "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:57:56.691Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8520-dibt-cve-20260526-0002-symlink-following-in-chown-chmod-critical"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware 8.4.18."
                }
              ],
              "value": "Upgrade to firmware 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12503",
        "datePublished": "2026-07-24T13:57:56.691Z",
        "dateReserved": "2026-06-17T09:48:11.206Z",
        "dateUpdated": "2026-07-24T14:57:47.202Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12502 (GCVE-0-2026-12502)

    Vulnerability from nvd – Published: 2026-07-24 13:57 – Updated: 2026-07-24 14:58
    VLAI
    Title
    Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo
    Summary
    Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-269 - Improper privilege management
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12502",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:58:09.849263Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:58:22.991Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Privilege Management (CWE-269)\u0026nbsp;in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."
                }
              ],
              "value": "Improper Privilege Management (CWE-269)\u00a0in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            },
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-269",
                  "description": "CWE-269 Improper privilege management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:57:44.001Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-20260526-0001-unrestricted-service-account-password-reset-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12502",
        "datePublished": "2026-07-24T13:57:44.001Z",
        "dateReserved": "2026-06-17T09:48:08.859Z",
        "dateUpdated": "2026-07-24T14:58:22.991Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12496 (GCVE-0-2026-12496)

    Vulnerability from nvd – Published: 2026-07-24 13:57 – Updated: 2026-07-24 15:01
    VLAI
    Title
    Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server
    Summary
    Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
    • CWE-116 - Improper encoding or escaping of output
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12496",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T15:01:05.617837Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T15:01:17.030Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Stored Cross-Site Scripting (CWE-79)\u0026nbsp;in the OPC XML-DA server statistics in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator\u0027s browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.\u003cbr\u003e"
                }
              ],
              "value": "Stored Cross-Site Scripting (CWE-79)\u00a0in the OPC XML-DA server statistics in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator\u0027s browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-592",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-592 Stored XSS"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-116",
                  "description": "CWE-116 Improper encoding or escaping of output",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:57:24.818Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8522-dibt-cve-20260526-0004-unauthenticated-stored-xxs-in-opc-xml-da-server-statistics-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12496",
        "datePublished": "2026-07-24T13:57:24.818Z",
        "dateReserved": "2026-06-17T08:57:07.049Z",
        "dateUpdated": "2026-07-24T15:01:17.030Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-55732 (GCVE-0-2026-55732)

    Vulnerability from cvelistv5 – Published: 2026-07-24 14:00 – Updated: 2026-07-24 14:53
    VLAI
    Title
    Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)
    Summary
    Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.18 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55732",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:53:38.766440Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:53:49.184Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Out-of-bounds Read (CWE-125)\u0026nbsp;in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."
                }
              ],
              "value": "Out-of-bounds Read (CWE-125)\u00a0in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-540",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-540 Overread Buffers"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-125",
                  "description": "CWE-125 Out-of-bounds read",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T14:00:48.771Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8532-dibt-cve-20260608-0001-bacnet-crash-due-to-invalid-timesync-message-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.20."
                }
              ],
              "value": "Upgrade to firmware version 8.4.20."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-55732",
        "datePublished": "2026-07-24T14:00:48.771Z",
        "dateReserved": "2026-06-17T09:48:05.268Z",
        "dateUpdated": "2026-07-24T14:53:49.184Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-55731 (GCVE-0-2026-55731)

    Vulnerability from cvelistv5 – Published: 2026-07-24 14:00 – Updated: 2026-07-24 14:54
    VLAI
    Title
    Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent
    Summary
    Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-606 - Unchecked input for loop condition
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55731",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:54:22.819899Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:54:34.007Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Unchecked input for loop condition (CWE-606)\u0026nbsp;in the SNMP agent in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component."
                }
              ],
              "value": "Unchecked input for loop condition (CWE-606)\u00a0in the SNMP agent in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) via a crafted SNMP GETNEXT request with a large OID component."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 6.6,
                "baseSeverity": "MEDIUM",
                "exploitMaturity": "UNREPORTED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-606",
                  "description": "CWE-606 Unchecked input for loop condition",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T14:00:30.497Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8531-dibt-cve-20260601-0003-unchecked-input-for-loop-condition-cwe-606-in-the-snmp-agent-medium"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-55731",
        "datePublished": "2026-07-24T14:00:30.497Z",
        "dateReserved": "2026-06-17T09:48:05.268Z",
        "dateUpdated": "2026-07-24T14:54:34.007Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-55728 (GCVE-0-2026-55728)

    Vulnerability from cvelistv5 – Published: 2026-07-24 13:58 – Updated: 2026-07-24 14:56
    VLAI
    Title
    Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict
    Summary
    Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-121 - Stack-based buffer overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55728",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:55:52.913648Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:56:40.020Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Stack-based Buffer Overflow (CWE-121)\u0026nbsp;in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in  Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument."
                }
              ],
              "value": "Stack-based Buffer Overflow (CWE-121)\u00a0in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in  Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-100",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-100 Overflow Buffers"
                }
              ]
            },
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "LOCAL",
                "baseScore": 3.8,
                "baseSeverity": "LOW",
                "exploitMaturity": "UNREPORTED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-121",
                  "description": "CWE-121 Stack-based buffer overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:58:35.474Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8523-dibt-cve-20260526-0005-stack-buffer-overflow-in-cmd_ipaddr_conflict-low"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-55728",
        "datePublished": "2026-07-24T13:58:35.474Z",
        "dateReserved": "2026-06-17T09:48:05.267Z",
        "dateUpdated": "2026-07-24T14:56:40.020Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12504 (GCVE-0-2026-12504)

    Vulnerability from cvelistv5 – Published: 2026-07-24 13:58 – Updated: 2026-07-24 14:57
    VLAI
    Title
    Loytec LINX firmware: Improper Authentication in PAM configuration
    Summary
    Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-287 - Improper authentication
    • CWE-521 - Weak password requirements
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12504",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:57:10.832151Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:57:20.563Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Authentication (CWE-287)\u0026nbsp;in the PAM configuration in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field."
                }
              ],
              "value": "Improper Authentication (CWE-287)\u00a0in the PAM configuration in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-115",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-115 Authentication Bypass"
                }
              ]
            },
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-287",
                  "description": "CWE-287 Improper authentication",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-521",
                  "description": "CWE-521 Weak password requirements",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:58:16.232Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8521-dibt-cve-20260526-0003-pam-passwordless-uid-0-authentication-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Improper Authentication in PAM configuration",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12504",
        "datePublished": "2026-07-24T13:58:16.232Z",
        "dateReserved": "2026-06-17T09:48:17.638Z",
        "dateUpdated": "2026-07-24T14:57:20.563Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12503 (GCVE-0-2026-12503)

    Vulnerability from cvelistv5 – Published: 2026-07-24 13:57 – Updated: 2026-07-24 14:57
    VLAI
    Title
    Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter
    Summary
    Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-59 - Improper link resolution before file access ('link following')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12503",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:57:37.633031Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:57:47.202Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Link Resolution (CWE-59)\u0026nbsp;in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`."
                }
              ],
              "value": "Improper Link Resolution (CWE-59)\u00a0in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            },
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 9.2,
                "baseSeverity": "CRITICAL",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-59",
                  "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:57:56.691Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8520-dibt-cve-20260526-0002-symlink-following-in-chown-chmod-critical"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware 8.4.18."
                }
              ],
              "value": "Upgrade to firmware 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12503",
        "datePublished": "2026-07-24T13:57:56.691Z",
        "dateReserved": "2026-06-17T09:48:11.206Z",
        "dateUpdated": "2026-07-24T14:57:47.202Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12502 (GCVE-0-2026-12502)

    Vulnerability from cvelistv5 – Published: 2026-07-24 13:57 – Updated: 2026-07-24 14:58
    VLAI
    Title
    Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo
    Summary
    Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-269 - Improper privilege management
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12502",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T14:58:09.849263Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T14:58:22.991Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Improper Privilege Management (CWE-269)\u0026nbsp;in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."
                }
              ],
              "value": "Improper Privilege Management (CWE-269)\u00a0in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-122",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-122 Privilege Abuse"
                }
              ]
            },
            {
              "capecId": "CAPEC-233",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-233 Privilege Escalation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-269",
                  "description": "CWE-269 Improper privilege management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:57:44.001Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-20260526-0001-unrestricted-service-account-password-reset-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12502",
        "datePublished": "2026-07-24T13:57:44.001Z",
        "dateReserved": "2026-06-17T09:48:08.859Z",
        "dateUpdated": "2026-07-24T14:58:22.991Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12496 (GCVE-0-2026-12496)

    Vulnerability from cvelistv5 – Published: 2026-07-24 13:57 – Updated: 2026-07-24 15:01
    VLAI
    Title
    Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server
    Summary
    Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
    • CWE-116 - Improper encoding or escaping of output
    Assigner
    References
    Impacted products
    Vendor Product Version
    Loytec LIP-ME20xC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-INX Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-GATE Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-ROC Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-IOB Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-DALI Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-VIS Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Loytec L-PAD Affected: 0 , ≤ 8.4.16 (custom)
    Create a notification for this product.
    Credits
    Daniel Hulliger, armasuisse CYD Campus Damian Pfammatter, armasuisse CYD Campus
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12496",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-24T15:01:05.617837Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-24T15:01:17.030Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "LIP-ME20xC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-INX",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-GATE",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-ROC",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-IOB",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-DALI",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-VIS",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "L-PAD",
              "vendor": "Loytec",
              "versions": [
                {
                  "lessThanOrEqual": "8.4.16",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Hulliger, armasuisse CYD Campus"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Damian Pfammatter, armasuisse CYD Campus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Stored Cross-Site Scripting (CWE-79)\u0026nbsp;in the OPC XML-DA server statistics in Loytec LIP-ME201C,\u0026nbsp;L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator\u0027s browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.\u003cbr\u003e"
                }
              ],
              "value": "Stored Cross-Site Scripting (CWE-79)\u00a0in the OPC XML-DA server statistics in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator\u0027s browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-592",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-592 Stored XSS"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-116",
                  "description": "CWE-116 Improper encoding or escaping of output",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-24T13:57:24.818Z",
            "orgId": "455daabc-a392-441d-aa46-37d35189897c",
            "shortName": "NCSC.ch"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.loytec.com/support/product-security/advisories/8522-dibt-cve-20260526-0004-unauthenticated-stored-xxs-in-opc-xml-da-server-statistics-high"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Upgrade to firmware version 8.4.18."
                }
              ],
              "value": "Upgrade to firmware version 8.4.18."
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server",
          "x_generator": {
            "engine": "Vulnogram 1.0.2"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
        "assignerShortName": "NCSC.ch",
        "cveId": "CVE-2026-12496",
        "datePublished": "2026-07-24T13:57:24.818Z",
        "dateReserved": "2026-06-17T08:57:07.049Z",
        "dateUpdated": "2026-07-24T15:01:17.030Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }