Which versions of Loytec L-INX are affected by EUVD-2026-48591?

Loytec building-automation controllers (L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD, LIP-ME20xC) running firmware 8.4.16 and earlier on LINX-A64 platforms contain a local privilege escalation…

How to fix or mitigate EUVD-2026-48591?

Within 24 hours: Inventory all Loytec building-automation systems in operation and document current firmware versions, specifically identifying any systems on firmware 8.4.16 or earlier; immediately restrict and audit access to the `larmapp` account across all affected systems. Within 7 days: Implement strict access controls limiting `larmapp` account privileges, enable file integrity monitoring on critical paths including `/etc/passwd` and `/etc/lighttpd/ssl/`, and configure audit logging for authentication and file modification events; subscribe to Loytec security bulletins for patch availability. Within 30 days: Develop a firmware upgrade strategy and prepare systems for patching once vendor releases updates beyond version 8.4.16; implement network segmentation to restrict local access to building-automation controllers and enforce least-privilege principles for management interfaces.

Loytec L-INX EUVD-2026-48591

Q: What is the CVSS score of EUVD-2026-48591?

EUVD-2026-48591 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-12503 CRITICAL

Improper Link Resolution Before File Access (CWE-59)

2026-07-24 NCSC.ch

GHSA-4p7f-6rpf-28mq

Privilege Escalation Lip Me20Xc L Inx L Gate L Roc L Iob L Dali L Vis L Pad

9.2

CVSS 4.0 · Vendor: NCSC.ch

Severity by source

Vendor (NCSC.ch) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local, authenticated `larmapp` account required (AV:L/PR:L), deterministic symlink-follow so AC:L, and root compromise yields full C:H/I:H/A:H on the same system (S:U).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (NCSC.ch).

CVSS VectorVendor: NCSC.ch

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 11:49 vuln.today

CVE Published

Jul 24, 2026 - 13:57 cve.org

CRITICAL 9.2

DescriptionCVE.org

Improper Link Resolution (CWE-59) in /usr/bin/larm_starter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated larmapp attacker to make /etc/passwd writable by the larmapp group (leading to root privilege escalation) via a symlink attack on /etc/lighttpd/ssl/server.pem.

AnalysisAI

Local privilege escalation in Loytec building-automation controllers (L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD and LIP-ME20xC) through firmware 8.4.16 on the LINX-A64 platform lets an authenticated larmapp account escalate to root. The privileged helper /usr/bin/larm_starter follows a symlink at /etc/lighttpd/ssl/server.pem when it applies chown/chmod, so an attacker who replaces that path with a link to /etc/passwd can make /etc/passwd writable by the larmapp group and then add or modify a root-equivalent account. There is no public exploit identified at time of analysis and EPSS is low (0.14%), consistent with CISA SSVC rating exploitation as 'none' but technical impact as 'total'.

Technical ContextAI

The affected devices are Loytec LINX-A64 embedded Linux building-automation and I/O controllers running a lighttpd web stack. The root cause is CWE-59 (Improper Link Resolution / symlink following): the setuid or root-run helper /usr/bin/larm_starter performs ownership/permission changes on /etc/lighttpd/ssl/server.pem (the TLS server certificate/key) without verifying that the path is a regular file rather than a symbolic link. Because the larmapp service account controls that location, it can substitute a symlink so the chown/chmod operates on an attacker-chosen target - here /etc/passwd. The CPE set (cpe:2.3:a:loytec:l-inx, l-gate, l-roc, l-iob, l-dali, l-vis, l-pad, lip-me20xc) shows a shared firmware base across the product family, so the same code path affects all listed models.

RemediationAI

Apply the Loytec firmware update that supersedes 8.4.16 for the affected LINX-A64 product family as directed in the vendor advisory (https://www.loytec.com/support/product-security/advisories/8520-dibt-cve-20260526-0002-symlink-following-in-chown-chmod-critical); the input does not state an exact fixed version, so treat 'the next release above 8.4.16' as the target and confirm the patched build number with Loytec support. Until patched, reduce exposure of the larmapp account: restrict and monitor local/application access to the device, ensure the web/app layer that could yield a larmapp foothold is not reachable from untrusted networks, and audit /etc/lighttpd/ssl/server.pem and /etc/passwd for unexpected symlinks or group-writable permissions. As a compensating control, place these controllers on an isolated management VLAN with access limited to trusted engineering workstations - this does not remove the flaw but sharply limits who can reach the account needed to trigger it.