L Pad
Monthly
We need to extract from the provided information and synthesize into the required JSON fields. Let's go through each field. Product name: The affected product is primarily the Loytec LIP-ME201C, but the vulnerability affects many products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. The description says "through 8.4.18 on LINX-A64". So the primary product might be LIP-ME201C or the whole family. Which to pick? "Loytec LIP-ME201C" seems specific. But it might be better to use "Loytec LIP-ME201C" as the main product? Or the family "Loytec LINX-A64" as in the description. The description mentions "Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64". So it's a range of products that share the same underlying software. The product name could be "Loytec BACnet Devices". But the instruction says 1-3 words only. I can use "Loytec LIP-ME201C" as the first listed, or "Loytec LINX-A64". I'll go with "Loytec LIP-ME201C" as it's the first in the list and a specific product. Or "Loytec BACnet Devices" is 3 words. But they want the specific product name, not a vulnerability type. So I'll use "Loytec LIP-ME201C". Actually the description says "on LINX-A64", which is the platform. So maybe the product is "Loytec LINX-A64"? But the CPE list includes many products like l-inx, l-gate, etc. So it's a group of products. I could say "Loytec Automation Devices" but that's generic. I'll choose "Loytec LIP-ME201C" to be specific. 1-3 words: "Loytec LIP-ME201C" (3 words). That's fine. Summary: Must be 2-3 sentences, original synthesis. Start with impact verb and product. E.g., "Denial of service in Loytec LIP-ME201C and related building automation devices allows..." The impact: crash linx_a64.exe and reboot device. So it's a DoS that forces device reboot. WHO: unauthenticated remote attacker via malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with invalid month value. So "Denial of service in Loytec LI
Persistent denial of service in Loytec LIP-ME201C and related building automation controllers through version 8.4.16 allows unauthenticated remote attackers to cause CPU exhaustion via a crafted SNMP GETNEXT request with a large OID component. This vulnerability, tracked as CVE-2026-55731 and assigned CVSS 4.0 base score 6.6, has an EPSS exploitation probability of 0.32% and is not known to be actively exploited at analysis time.
Privilege escalation in Loytec ltsudo utility on LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through 8.4.16 allows a superadmin-group attacker to execute arbitrary code as root via a long interface-name argument to the cmd_ipaddr_conflict function. The vulnerability is a stack-based buffer overflow (CWE-121) in the SUID-root binary. No active exploitation or public exploit code identified at time of analysis.
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
We need to produce a JSON object based on given instructions. Fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Input: CVE-2026-12503 description, CVSS 4.0 vector, EPSS 0.14% (low), tags, CPEs, SSVC: exploitation none, automatable no, technical impact total. References include Loytec advisory and NVD link. Also "Reported by: NCSC.ch". Affected versions from EUVD up to 8.4.16 on LINX-A64 (maybe specific platform?). Description: Improper Link Resolution (CWE-59) in /usr/bin/larm_starter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`. So local authenticated as larmapp user, requires ability to create symlink on that specific file. Attack leads to /etc/passwd becoming group-writable by larmapp group, then can add root account. So privilege escalation from larmapp to root. CVSS 4.0: AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N. PR:H means high privileges required (likely larmapp is a privileged user/group). However, description says "authenticated larmapp attacker". larmapp could be a low-privileged user? Wait: "larmapp" might be a service account, but the PR:H indicates high privileges needed. So the attacker already has larmapp privileges. Is larmapp high-privileged? Possibly a user with certain permissions. But we can use that vector as basis for assessment. SSVC says none exploitation, not automatable (no), total impact. EPSS low. So overall risk: local, high privileges, not currently exploited, not automatable, but leads to root. For risk assessment we can say it's a significant local privilege escalati
A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.
We need to produce a JSON with the specified fields. Data: CVE-2026-12496: Stored XSS in OPC XML-DA server statistics in multiple Loytec products through 8.4.16 on LINX-A64. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS 0.36% (low). CISA KEV not mentioned, no POC data explicitly? Input has no KEV status, Tags: XSS, etc. SSVC: Exploitation none, Automatable no, Technical Impact total. Affected versions: 0 <= 8.4.16 for all products. References: loytec advisory and NVD. No patch version given. Description says "through 8.4.16", so maybe 8.4.16 is the vulnerable ending version, but no fixed version. No exact fix version. Also, note: the CVE says "on LINX-A64", but the products are different. Probably these are Loytec building automation products. The vulnerability: unauthenticated remote attacker can inject stored XSS via User-Agent header in POST /da request, which executes in admin browser. So condition: OPC XML-DA server statistics accessed by admin. Possibly requires admin viewing the stats page. CVSS 4.0: UI:P (user interaction required to trigger), so the attack requires an admin to view the malicious data. AV:N, AC:L, PR:N, UI:P. So it's unauthenticated but requires user interaction (the admin viewing the page). Also, EPSS low, no active exploitation, no KEV. We need to construct all fields accordingly. No KEV, so "no public exploit identified at time of analysis" (since POC not mentioned either). No explicit POC data, so "no public exploit identified at time of analysis" (I'll use that). EPSS 0.36% is very low, so risk is low despite high impact. But stored XSS could lead to admin compromise, so high impact. product_name: Loytec LW-series? Actually products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. They are all Loytec building automation devices. I'll pick a representative, maybe "Loytec L-INX" or "Loytec L-GATE"? The CPE list includes lip-me20xc, l-inx, l-gate, etc. So product_name: "Loytec L-INX" (one of
We need to extract from the provided information and synthesize into the required JSON fields. Let's go through each field. Product name: The affected product is primarily the Loytec LIP-ME201C, but the vulnerability affects many products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. The description says "through 8.4.18 on LINX-A64". So the primary product might be LIP-ME201C or the whole family. Which to pick? "Loytec LIP-ME201C" seems specific. But it might be better to use "Loytec LIP-ME201C" as the main product? Or the family "Loytec LINX-A64" as in the description. The description mentions "Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64". So it's a range of products that share the same underlying software. The product name could be "Loytec BACnet Devices". But the instruction says 1-3 words only. I can use "Loytec LIP-ME201C" as the first listed, or "Loytec LINX-A64". I'll go with "Loytec LIP-ME201C" as it's the first in the list and a specific product. Or "Loytec BACnet Devices" is 3 words. But they want the specific product name, not a vulnerability type. So I'll use "Loytec LIP-ME201C". Actually the description says "on LINX-A64", which is the platform. So maybe the product is "Loytec LINX-A64"? But the CPE list includes many products like l-inx, l-gate, etc. So it's a group of products. I could say "Loytec Automation Devices" but that's generic. I'll choose "Loytec LIP-ME201C" to be specific. 1-3 words: "Loytec LIP-ME201C" (3 words). That's fine. Summary: Must be 2-3 sentences, original synthesis. Start with impact verb and product. E.g., "Denial of service in Loytec LIP-ME201C and related building automation devices allows..." The impact: crash linx_a64.exe and reboot device. So it's a DoS that forces device reboot. WHO: unauthenticated remote attacker via malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with invalid month value. So "Denial of service in Loytec LI
Persistent denial of service in Loytec LIP-ME201C and related building automation controllers through version 8.4.16 allows unauthenticated remote attackers to cause CPU exhaustion via a crafted SNMP GETNEXT request with a large OID component. This vulnerability, tracked as CVE-2026-55731 and assigned CVSS 4.0 base score 6.6, has an EPSS exploitation probability of 0.32% and is not known to be actively exploited at analysis time.
Privilege escalation in Loytec ltsudo utility on LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through 8.4.16 allows a superadmin-group attacker to execute arbitrary code as root via a long interface-name argument to the cmd_ipaddr_conflict function. The vulnerability is a stack-based buffer overflow (CWE-121) in the SUID-root binary. No active exploitation or public exploit code identified at time of analysis.
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
We need to produce a JSON object based on given instructions. Fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Input: CVE-2026-12503 description, CVSS 4.0 vector, EPSS 0.14% (low), tags, CPEs, SSVC: exploitation none, automatable no, technical impact total. References include Loytec advisory and NVD link. Also "Reported by: NCSC.ch". Affected versions from EUVD up to 8.4.16 on LINX-A64 (maybe specific platform?). Description: Improper Link Resolution (CWE-59) in /usr/bin/larm_starter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`. So local authenticated as larmapp user, requires ability to create symlink on that specific file. Attack leads to /etc/passwd becoming group-writable by larmapp group, then can add root account. So privilege escalation from larmapp to root. CVSS 4.0: AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N. PR:H means high privileges required (likely larmapp is a privileged user/group). However, description says "authenticated larmapp attacker". larmapp could be a low-privileged user? Wait: "larmapp" might be a service account, but the PR:H indicates high privileges needed. So the attacker already has larmapp privileges. Is larmapp high-privileged? Possibly a user with certain permissions. But we can use that vector as basis for assessment. SSVC says none exploitation, not automatable (no), total impact. EPSS low. So overall risk: local, high privileges, not currently exploited, not automatable, but leads to root. For risk assessment we can say it's a significant local privilege escalati
A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.
We need to produce a JSON with the specified fields. Data: CVE-2026-12496: Stored XSS in OPC XML-DA server statistics in multiple Loytec products through 8.4.16 on LINX-A64. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS 0.36% (low). CISA KEV not mentioned, no POC data explicitly? Input has no KEV status, Tags: XSS, etc. SSVC: Exploitation none, Automatable no, Technical Impact total. Affected versions: 0 <= 8.4.16 for all products. References: loytec advisory and NVD. No patch version given. Description says "through 8.4.16", so maybe 8.4.16 is the vulnerable ending version, but no fixed version. No exact fix version. Also, note: the CVE says "on LINX-A64", but the products are different. Probably these are Loytec building automation products. The vulnerability: unauthenticated remote attacker can inject stored XSS via User-Agent header in POST /da request, which executes in admin browser. So condition: OPC XML-DA server statistics accessed by admin. Possibly requires admin viewing the stats page. CVSS 4.0: UI:P (user interaction required to trigger), so the attack requires an admin to view the malicious data. AV:N, AC:L, PR:N, UI:P. So it's unauthenticated but requires user interaction (the admin viewing the page). Also, EPSS low, no active exploitation, no KEV. We need to construct all fields accordingly. No KEV, so "no public exploit identified at time of analysis" (since POC not mentioned either). No explicit POC data, so "no public exploit identified at time of analysis" (I'll use that). EPSS 0.36% is very low, so risk is low despite high impact. But stored XSS could lead to admin compromise, so high impact. product_name: Loytec LW-series? Actually products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. They are all Loytec building automation devices. I'll pick a representative, maybe "Loytec L-INX" or "Loytec L-GATE"? The CPE list includes lip-me20xc, l-inx, l-gate, etc. So product_name: "Loytec L-INX" (one of