Lip Me20Xc CVE-2026-12502

Q: What is the CVSS score of CVE-2026-12502?

CVE-2026-12502 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-48590 HIGH

Improper Privilege Management (CWE-269)

2026-07-24 NCSC.ch

GHSA-x5vq-r47f-779j

Privilege Escalation Lip Me20Xc L Inx L Gate L Roc L Iob L Dali L Vis L Pad Loytec

8.4

CVSS 4.0 · Vendor: NCSC.ch

Severity by source

Vendor (NCSC.ch) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (NCSC.ch) · only source for this CVE.

CVSS VectorVendor: NCSC.ch

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 11:49 vuln.today

CVE Published

Jul 24, 2026 - 13:57 cve.org

HIGH 8.4

DescriptionCVE.org

Improper Privilege Management (CWE-269) in /usr/bin/ltsudo in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a superadmin-group attacker to reset the password of any LARM user (including the larmapp service account) via the set-passwd subcommand.

AnalysisAI

A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.