L Gate
Monthly
Remote denial-of-service in Loytec LINX-A64-based building automation controllers through firmware 8.4.18 allows an unauthenticated network attacker to crash the `linx_a64.exe` process and reboot the device by sending a single malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet carrying an invalid month value. The root cause is an out-of-bounds read (CWE-125) in `bacdt_datetime_to_tod` during datetime parsing, with no authentication barrier and no user interaction required. No public exploit or active exploitation has been identified at time of analysis, but the SSVC automatable classification means mass scanning and crashing of exposed BACnet devices is trivially scriptable.
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
Local privilege escalation in Loytec building-automation controllers (L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD and LIP-ME20xC) through firmware 8.4.16 on the LINX-A64 platform lets an authenticated `larmapp` account escalate to root. The privileged helper `/usr/bin/larm_starter` follows a symlink at `/etc/lighttpd/ssl/server.pem` when it applies chown/chmod, so an attacker who replaces that path with a link to `/etc/passwd` can make `/etc/passwd` writable by the `larmapp` group and then add or modify a root-equivalent account. There is no public exploit identified at time of analysis and EPSS is low (0.14%), consistent with CISA SSVC rating exploitation as 'none' but technical impact as 'total'.
A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.
Stored XSS in the OPC XML-DA server statistics endpoint of multiple Loytec building automation devices allows an unauthenticated remote attacker to inject and persistently store arbitrary JavaScript by supplying a crafted User-Agent header in a POST request to the /da endpoint. When an administrator subsequently views the statistics page, the payload executes in their browser, enabling session hijacking, credential theft, and unauthorized device reconfiguration. Affected products include LIP-ME20xC, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD running firmware through 8.4.16 on the LINX-A64 platform; no public exploit or KEV listing has been identified as of this analysis.
Persistent denial of service in Loytec LIP-ME201C and related building automation controllers through version 8.4.16 allows unauthenticated remote attackers to cause CPU exhaustion via a crafted SNMP GETNEXT request with a large OID component. This vulnerability, tracked as CVE-2026-55731 and assigned CVSS 4.0 base score 6.6, has an EPSS exploitation probability of 0.32% and is not known to be actively exploited at analysis time.
Privilege escalation in Loytec ltsudo utility on LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through 8.4.16 allows a superadmin-group attacker to execute arbitrary code as root via a long interface-name argument to the cmd_ipaddr_conflict function. The vulnerability is a stack-based buffer overflow (CWE-121) in the SUID-root binary. No active exploitation or public exploit code identified at time of analysis.
Remote denial-of-service in Loytec LINX-A64-based building automation controllers through firmware 8.4.18 allows an unauthenticated network attacker to crash the `linx_a64.exe` process and reboot the device by sending a single malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet carrying an invalid month value. The root cause is an out-of-bounds read (CWE-125) in `bacdt_datetime_to_tod` during datetime parsing, with no authentication barrier and no user interaction required. No public exploit or active exploitation has been identified at time of analysis, but the SSVC automatable classification means mass scanning and crashing of exposed BACnet devices is trivially scriptable.
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
Local privilege escalation in Loytec building-automation controllers (L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD and LIP-ME20xC) through firmware 8.4.16 on the LINX-A64 platform lets an authenticated `larmapp` account escalate to root. The privileged helper `/usr/bin/larm_starter` follows a symlink at `/etc/lighttpd/ssl/server.pem` when it applies chown/chmod, so an attacker who replaces that path with a link to `/etc/passwd` can make `/etc/passwd` writable by the `larmapp` group and then add or modify a root-equivalent account. There is no public exploit identified at time of analysis and EPSS is low (0.14%), consistent with CISA SSVC rating exploitation as 'none' but technical impact as 'total'.
A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.
Stored XSS in the OPC XML-DA server statistics endpoint of multiple Loytec building automation devices allows an unauthenticated remote attacker to inject and persistently store arbitrary JavaScript by supplying a crafted User-Agent header in a POST request to the /da endpoint. When an administrator subsequently views the statistics page, the payload executes in their browser, enabling session hijacking, credential theft, and unauthorized device reconfiguration. Affected products include LIP-ME20xC, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD running firmware through 8.4.16 on the LINX-A64 platform; no public exploit or KEV listing has been identified as of this analysis.
Persistent denial of service in Loytec LIP-ME201C and related building automation controllers through version 8.4.16 allows unauthenticated remote attackers to cause CPU exhaustion via a crafted SNMP GETNEXT request with a large OID component. This vulnerability, tracked as CVE-2026-55731 and assigned CVSS 4.0 base score 6.6, has an EPSS exploitation probability of 0.32% and is not known to be actively exploited at analysis time.
Privilege escalation in Loytec ltsudo utility on LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through 8.4.16 allows a superadmin-group attacker to execute arbitrary code as root via a long interface-name argument to the cmd_ipaddr_conflict function. The vulnerability is a stack-based buffer overflow (CWE-121) in the SUID-root binary. No active exploitation or public exploit code identified at time of analysis.