Loytec LINX Devices CVE-2026-12496

An attacker must have TCP/HTTP access to the Loytec device's OPC XML-DA endpoint (POST /da) - no authentication is required for the injection step. The firmware version must be 8.4.16 or earlier on LINX-A64 hardware. Payload execution requires a legitimate administrator to subsequently navigate to the OPC XML-DA server statistics page in a browser while authenticated; this is the sole user-interaction gating condition (CVSS UI:P). Exploitation is further limited by the requirement that the device's statistics page renders the User-Agent field without encoding, which is intrinsic to the unfixed firmware. Limiting factors: the device must be network-reachable to the attacker (Loytec building automation devices are frequently on isolated OT segments not directly exposed to the internet); the attacker cannot control when an admin views the page; and SSVC Automatable:no reflects that the UI:P step prevents fully automated end-to-end exploitation.

The official CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scores 8.7 and accurately captures network reachability, no-auth injection, and high downstream impact conditional on admin interaction. SSVC classifies Technical Impact as total but Automatable as no and Exploitation as none, meaning fully automated mass exploitation is not expected. EPSS at 0.36% (28th percentile) likewise signals low near-term exploitation probability. Taken together, these signals depict a real but non-imminent risk: an attacker must be able to reach the OPC XML-DA endpoint and then wait for an admin to view statistics, making drive-by mass exploitation impractical without the UI trigger. However, for operational technology environments where Loytec controllers govern HVAC, lighting, or access systems - even a mid-sized municipal building operator in inowroclaw should treat this as urgent given that a successful attack grants effective admin control over physical-world infrastructure. No public exploit code or KEV listing exists at the time of this analysis, but NCSC.ch reporting indicates it has been submitted through coordinated disclosure.

An attacker with network access to a Loytec device (e.g., via a compromised OT network segment or an internet-exposed management interface) sends a single unauthenticated POST request to /da with a User-Agent header containing a JavaScript payload such as a cookie-stealing script. The payload is stored in the device's OPC XML-DA statistics log. The next time a legitimate administrator opens the statistics dashboard, the script executes in their browser, exfiltrating their session token to an attacker-controlled server and allowing the attacker to assume the admin session and reconfigure the device. No public proof-of-concept exploit has been identified, but the attack is conceptually straightforward and requires only standard HTTP tooling.