Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (NCSC.ch) · only source for this CVE.
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
3DescriptionCVE.org
Exposure of Sensitive Information (CWE-200) in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link.
AnalysisAI
We need to output a JSON object with the specified fields. The input provides: CVE-2026-55729, description, CVSS 4.0 vector, EPSS, patch availability, tags, SSVC, ENISA, affected versions, references. We must synthesize.
First, product_name: "Loytec LWEB-802" (1-3 words). It's a specific product: "LWEB-802". So "Loytec LWEB-802" fits (3 words). Yes.
summary: Plain-language for security pros. Original synthesis, not copying description. Start with impact verb. Description says exposure of sensitive information, leaking stored management credentials via crafted link, unauthenticated remote attacker. Affected before 5.0.8 on all platforms. So: "Credential disclosure in Loytec LWEB-802 prior to 5.0.8 allows unauthenticated remote attackers to steal browser-stored management credentials through a malicious link." Mention EPSS 0.32% (low), no KEV, POC status unknown (not mentioned, but "no public exploit identified" since no POC tag? Tags: Information Disclosure, Lweb 802. SSVC: exploitation none. So active exploitation none. So: "No active exploitation reported, and EPSS score is low (0.32%), but the exposure is high-impact." And state CVSS 4.0 base score 7.7 (High). Also mention patch available. So: "Patched in version 5.0.8, with no known in-the-wild exploitation." No KEV, so not actively exploited. So summary: "Credential theft from browser local storage in Loytec LWEB-802 prior to version 5.0.8 enables remote unauthenticated attackers to exfiltrate stored management credentials by tricking a user into clicking a crafted link. The vulnerability has a low EPSS probability (0.32%) and no reported exploitation, but the CVSS 4.0 base score of 7.7 reflects high confidentiality, integrity, and availability impact on the vulnerable system." Keep concise. Since CVSS 4.0 vector is given, I'll note impact high. Actually, CVSS 4.0 vector: VC:H/VI:H/VA:H. So high impact to confidentiality, integrity, availability on vulnerable component. That is the browser's local storage? The
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-48594
GHSA-c4x3-39wp-wf7p