Skip to main content

Lweb 802 CVE-2026-55729

| EUVDEUVD-2026-48594 HIGH
Information Exposure (CWE-200)
2026-07-24 NCSC.ch GHSA-c4x3-39wp-wf7p
7.7
CVSS 4.0 · Vendor: NCSC.ch
Share

Severity by source

Vendor (NCSC.ch) PRIMARY
7.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (NCSC.ch) · only source for this CVE.

CVSS VectorVendor: NCSC.ch

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Analysis Generated
Jul 26, 2026 - 11:48 vuln.today
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 13:59 cve.org
HIGH 7.7

DescriptionCVE.org

Exposure of Sensitive Information (CWE-200) in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link.

AnalysisAI

We need to output a JSON object with the specified fields. The input provides: CVE-2026-55729, description, CVSS 4.0 vector, EPSS, patch availability, tags, SSVC, ENISA, affected versions, references. We must synthesize.

First, product_name: "Loytec LWEB-802" (1-3 words). It's a specific product: "LWEB-802". So "Loytec LWEB-802" fits (3 words). Yes.

summary: Plain-language for security pros. Original synthesis, not copying description. Start with impact verb. Description says exposure of sensitive information, leaking stored management credentials via crafted link, unauthenticated remote attacker. Affected before 5.0.8 on all platforms. So: "Credential disclosure in Loytec LWEB-802 prior to 5.0.8 allows unauthenticated remote attackers to steal browser-stored management credentials through a malicious link." Mention EPSS 0.32% (low), no KEV, POC status unknown (not mentioned, but "no public exploit identified" since no POC tag? Tags: Information Disclosure, Lweb 802. SSVC: exploitation none. So active exploitation none. So: "No active exploitation reported, and EPSS score is low (0.32%), but the exposure is high-impact." And state CVSS 4.0 base score 7.7 (High). Also mention patch available. So: "Patched in version 5.0.8, with no known in-the-wild exploitation." No KEV, so not actively exploited. So summary: "Credential theft from browser local storage in Loytec LWEB-802 prior to version 5.0.8 enables remote unauthenticated attackers to exfiltrate stored management credentials by tricking a user into clicking a crafted link. The vulnerability has a low EPSS probability (0.32%) and no reported exploitation, but the CVSS 4.0 base score of 7.7 reflects high confidentiality, integrity, and availability impact on the vulnerable system." Keep concise. Since CVSS 4.0 vector is given, I'll note impact high. Actually, CVSS 4.0 vector: VC:H/VI:H/VA:H. So high impact to confidentiality, integrity, availability on vulnerable component. That is the browser's local storage? The

Share

CVE-2026-55729 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy