Loytec LINX CVE-2026-55732

Exploitation requires network-level reachability to a Loytec LINX-A64 device running firmware 8.4.18 or earlier over BACnet/IP (typically UDP port 47808). No authentication is required (CVSS PR:N). The BACnet TimeSynchronization service must be reachable from the attacker's network - a service that is standard-on for these building controllers. What limits real-world exploitation: BACnet devices are architecturally intended for isolated OT/BAS network segments, and most properly secured deployments do not expose UDP 47808 to untrusted or internet-facing networks; correct network segmentation eliminates the attack vector entirely. The vulnerability is availability-only - no code execution, privilege escalation, or data exfiltration capability is established by available data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is well-calibrated for this vulnerability: network-accessible, no authentication, no complexity threshold, but impact strictly limited to availability with zero confidentiality or integrity consequence. EPSS at 0.32% (25th percentile) and SSVC exploitation status 'none' together indicate no observed or imminent exploitation at time of analysis. The SSVC 'automatable: yes' designation is the most operationally significant signal - a single malformed UDP packet to port 47808 is sufficient to crash any reachable device, and mass scanning is trivially scriptable. In OT/BAS contexts, even a brief availability loss in a mid-sized facility in mielec could cause HVAC outages, lighting failures, or access control disruptions with real physical consequences, making deployment context the primary risk multiplier. The input tags 'Buffer Overflow' and 'Information Disclosure' are inaccurate for this vulnerability, which is a read-triggered crash with no confirmed write primitive and no confidentiality impact per CVSS VC:N - this overstates the technical capability of the flaw. Real-world exploitability is strongly gated by whether BACnet/IP is reachable from untrusted networks; properly segmented OT environments face negligible exposure.

An attacker with network access to BACnet/IP (UDP port 47808) on an unpatched Loytec LINX-A64 device crafts a BACnet APDU with the TimeSynchronization service code and sets the month field to an invalid value such as 0x00 or 0xFF. Upon receipt, bacdt_datetime_to_tod performs an out-of-bounds read, causing linx_a64.exe to crash and forcing the controller to reboot, temporarily disabling whatever HVAC, lighting, or access control functions it manages. No authentication is required and no public exploit code has been identified, but the attack is a single-packet operation easily scripted for automated scanning of BACnet-exposed infrastructure.