Lip Me20Xc CVE-2026-12496

We need to produce a JSON with the specified fields. Data: CVE-2026-12496: Stored XSS in OPC XML-DA server statistics in multiple Loytec products through 8.4.16 on LINX-A64. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS 0.36% (low). CISA KEV not mentioned, no POC data explicitly? Input has no KEV status, Tags: XSS, etc. SSVC: Exploitation none, Automatable no, Technical Impact total. Affected versions: 0 <= 8.4.16 for all products. References: loytec advisory and NVD. No patch version given. Description says "through 8.4.16", so maybe 8.4.16 is the vulnerable ending version, but no fixed version. No exact fix version. Also, note: the CVE says "on LINX-A64", but the products are different. Probably these are Loytec building automation products. The vulnerability: unauthenticated remote attacker can inject stored XSS via User-Agent header in POST /da request, which executes in admin browser. So condition: OPC XML-DA server statistics accessed by admin. Possibly requires admin viewing the stats page. CVSS 4.0: UI:P (user interaction required to trigger), so the attack requires an admin to view the malicious data. AV:N, AC:L, PR:N, UI:P. So it's unauthenticated but requires user interaction (the admin viewing the page). Also, EPSS low, no active exploitation, no KEV.

We need to construct all fields accordingly. No KEV, so "no public exploit identified at time of analysis" (since POC not mentioned either). No explicit POC data, so "no public exploit identified at time of analysis" (I'll use that). EPSS 0.36% is very low, so risk is low despite high impact. But stored XSS could lead to admin compromise, so high impact.

product_name: Loytec LW-series? Actually products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. They are all Loytec building automation devices. I'll pick a representative, maybe "Loytec L-INX" or "Loytec L-GATE"? The CPE list includes lip-me20xc, l-inx, l-gate, etc. So product_name: "Loytec L-INX" (one of