Loytec LWEB-802 CVE-2026-55729

The victim must have an active, authenticated session in the Loytec LWEB-802 browser interface at the time they click the crafted link - credentials must already be persisted in the browser's localStorage (i.e., the user has previously logged in without clearing storage). The attacker must be able to deliver the crafted link to the victim and induce them to click it (UI:P). The CVSS AT:P confirms a specific attack requirement is present. Exploitation is limited by: (1) requirement for an active authenticated session in the browser, (2) user must interact with the crafted link, (3) SSVC Automatable: no - mass automated exploitation across targets is not feasible due to the UI and session preconditions, and (4) EPSS 0.32% with no current exploitation observed. No exploitation is possible against users who are not logged into LWEB-802 or who have cleared their browser storage.

The vendor-assigned CVSS 4.0 score of 7.7 with VC:H/VI:H/VA:H reflects the downstream impact of stolen credentials yielding full system control, which aligns with SSVC Technical Impact: total. However, the direct vulnerability impact is credential disclosure (C:H, I:N, A:N), and the I:H/A:H values represent secondary abuse of stolen credentials rather than the flaw itself. Balancing against this, the AT:P attack requirement (active authenticated browser session) and UI:P (victim must click a crafted link) meaningfully constrain exploitability. EPSS of 0.32% at the 25th percentile is consistent with SSVC Exploitation: none and no public exploit or KEV listing, indicating no active or automated exploitation is observed. The real-world risk is highest in scenarios where LWEB-802 operators receive external communications (email, messaging) that could deliver crafted links - standard social engineering in OT/ICS environments. The product's niche industrial deployment limits overall population at risk, but within those deployments, compromise of management credentials is a critical outcome given the physical consequences of building automation control.

An attacker identifies a target organization using Loytec LWEB-802 for building automation management (e.g., via public procurement documents or vendor registrations). The attacker emails a building engineer a convincing pretext message containing a crafted URL that, when clicked by the engineer while logged into the LWEB-802 interface, triggers a cross-site exfiltration of credentials stored in localStorage to an attacker-controlled server. No public exploit code has been identified at time of analysis, but the technique (localStorage exfiltration via crafted link) is well understood and reproducible from publicly documented web security research.