Loytec
Monthly
We need to extract from the provided information and synthesize into the required JSON fields. Let's go through each field. Product name: The affected product is primarily the Loytec LIP-ME201C, but the vulnerability affects many products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. The description says "through 8.4.18 on LINX-A64". So the primary product might be LIP-ME201C or the whole family. Which to pick? "Loytec LIP-ME201C" seems specific. But it might be better to use "Loytec LIP-ME201C" as the main product? Or the family "Loytec LINX-A64" as in the description. The description mentions "Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64". So it's a range of products that share the same underlying software. The product name could be "Loytec BACnet Devices". But the instruction says 1-3 words only. I can use "Loytec LIP-ME201C" as the first listed, or "Loytec LINX-A64". I'll go with "Loytec LIP-ME201C" as it's the first in the list and a specific product. Or "Loytec BACnet Devices" is 3 words. But they want the specific product name, not a vulnerability type. So I'll use "Loytec LIP-ME201C". Actually the description says "on LINX-A64", which is the platform. So maybe the product is "Loytec LINX-A64"? But the CPE list includes many products like l-inx, l-gate, etc. So it's a group of products. I could say "Loytec Automation Devices" but that's generic. I'll choose "Loytec LIP-ME201C" to be specific. 1-3 words: "Loytec LIP-ME201C" (3 words). That's fine. Summary: Must be 2-3 sentences, original synthesis. Start with impact verb and product. E.g., "Denial of service in Loytec LIP-ME201C and related building automation devices allows..." The impact: crash linx_a64.exe and reboot device. So it's a DoS that forces device reboot. WHO: unauthenticated remote attacker via malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with invalid month value. So "Denial of service in Loytec LI
Reflected Cross-Site Scripting in Loytec LWEB-802 versions prior to 5.0.8 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a crafted link containing malicious project or mspParams parameters. No active exploitation has been observed in the wild and EPSS indicates a low probability of exploitation (0.36%). Vendor has released a fix in version 5.0.8.
We need to output a JSON object with the specified fields. The input provides: CVE-2026-55729, description, CVSS 4.0 vector, EPSS, patch availability, tags, SSVC, ENISA, affected versions, references. We must synthesize. First, product_name: "Loytec LWEB-802" (1-3 words). It's a specific product: "LWEB-802". So "Loytec LWEB-802" fits (3 words). Yes. summary: Plain-language for security pros. Original synthesis, not copying description. Start with impact verb. Description says exposure of sensitive information, leaking stored management credentials via crafted link, unauthenticated remote attacker. Affected before 5.0.8 on all platforms. So: "Credential disclosure in Loytec LWEB-802 prior to 5.0.8 allows unauthenticated remote attackers to steal browser-stored management credentials through a malicious link." Mention EPSS 0.32% (low), no KEV, POC status unknown (not mentioned, but "no public exploit identified" since no POC tag? Tags: Information Disclosure, Lweb 802. SSVC: exploitation none. So active exploitation none. So: "No active exploitation reported, and EPSS score is low (0.32%), but the exposure is high-impact." And state CVSS 4.0 base score 7.7 (High). Also mention patch available. So: "Patched in version 5.0.8, with no known in-the-wild exploitation." No KEV, so not actively exploited. So summary: "Credential theft from browser local storage in Loytec LWEB-802 prior to version 5.0.8 enables remote unauthenticated attackers to exfiltrate stored management credentials by tricking a user into clicking a crafted link. The vulnerability has a low EPSS probability (0.32%) and no reported exploitation, but the CVSS 4.0 base score of 7.7 reflects high confidentiality, integrity, and availability impact on the vulnerable system." Keep concise. Since CVSS 4.0 vector is given, I'll note impact high. Actually, CVSS 4.0 vector: VC:H/VI:H/VA:H. So high impact to confidentiality, integrity, availability on vulnerable component. That is the browser's local storage? The
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
We need to produce a JSON object based on given instructions. Fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Input: CVE-2026-12503 description, CVSS 4.0 vector, EPSS 0.14% (low), tags, CPEs, SSVC: exploitation none, automatable no, technical impact total. References include Loytec advisory and NVD link. Also "Reported by: NCSC.ch". Affected versions from EUVD up to 8.4.16 on LINX-A64 (maybe specific platform?). Description: Improper Link Resolution (CWE-59) in /usr/bin/larm_starter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`. So local authenticated as larmapp user, requires ability to create symlink on that specific file. Attack leads to /etc/passwd becoming group-writable by larmapp group, then can add root account. So privilege escalation from larmapp to root. CVSS 4.0: AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N. PR:H means high privileges required (likely larmapp is a privileged user/group). However, description says "authenticated larmapp attacker". larmapp could be a low-privileged user? Wait: "larmapp" might be a service account, but the PR:H indicates high privileges needed. So the attacker already has larmapp privileges. Is larmapp high-privileged? Possibly a user with certain permissions. But we can use that vector as basis for assessment. SSVC says none exploitation, not automatable (no), total impact. EPSS low. So overall risk: local, high privileges, not currently exploited, not automatable, but leads to root. For risk assessment we can say it's a significant local privilege escalati
A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.
We need to produce a JSON with the specified fields. Data: CVE-2026-12496: Stored XSS in OPC XML-DA server statistics in multiple Loytec products through 8.4.16 on LINX-A64. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS 0.36% (low). CISA KEV not mentioned, no POC data explicitly? Input has no KEV status, Tags: XSS, etc. SSVC: Exploitation none, Automatable no, Technical Impact total. Affected versions: 0 <= 8.4.16 for all products. References: loytec advisory and NVD. No patch version given. Description says "through 8.4.16", so maybe 8.4.16 is the vulnerable ending version, but no fixed version. No exact fix version. Also, note: the CVE says "on LINX-A64", but the products are different. Probably these are Loytec building automation products. The vulnerability: unauthenticated remote attacker can inject stored XSS via User-Agent header in POST /da request, which executes in admin browser. So condition: OPC XML-DA server statistics accessed by admin. Possibly requires admin viewing the stats page. CVSS 4.0: UI:P (user interaction required to trigger), so the attack requires an admin to view the malicious data. AV:N, AC:L, PR:N, UI:P. So it's unauthenticated but requires user interaction (the admin viewing the page). Also, EPSS low, no active exploitation, no KEV. We need to construct all fields accordingly. No KEV, so "no public exploit identified at time of analysis" (since POC not mentioned either). No explicit POC data, so "no public exploit identified at time of analysis" (I'll use that). EPSS 0.36% is very low, so risk is low despite high impact. But stored XSS could lead to admin compromise, so high impact. product_name: Loytec LW-series? Actually products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. They are all Loytec building automation devices. I'll pick a representative, maybe "Loytec L-INX" or "Loytec L-GATE"? The CPE list includes lip-me20xc, l-inx, l-gate, etc. So product_name: "Loytec L-INX" (one of
Persistent denial of service in Loytec LIP-ME201C and related building automation controllers through version 8.4.16 allows unauthenticated remote attackers to cause CPU exhaustion via a crafted SNMP GETNEXT request with a large OID component. This vulnerability, tracked as CVE-2026-55731 and assigned CVSS 4.0 base score 6.6, has an EPSS exploitation probability of 0.32% and is not known to be actively exploited at analysis time.
Privilege escalation in Loytec ltsudo utility on LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through 8.4.16 allows a superadmin-group attacker to execute arbitrary code as root via a long interface-name argument to the cmd_ipaddr_conflict function. The vulnerability is a stack-based buffer overflow (CWE-121) in the SUID-root binary. No active exploitation or public exploit code identified at time of analysis.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpal_config.zml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
We need to extract from the provided information and synthesize into the required JSON fields. Let's go through each field. Product name: The affected product is primarily the Loytec LIP-ME201C, but the vulnerability affects many products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. The description says "through 8.4.18 on LINX-A64". So the primary product might be LIP-ME201C or the whole family. Which to pick? "Loytec LIP-ME201C" seems specific. But it might be better to use "Loytec LIP-ME201C" as the main product? Or the family "Loytec LINX-A64" as in the description. The description mentions "Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64". So it's a range of products that share the same underlying software. The product name could be "Loytec BACnet Devices". But the instruction says 1-3 words only. I can use "Loytec LIP-ME201C" as the first listed, or "Loytec LINX-A64". I'll go with "Loytec LIP-ME201C" as it's the first in the list and a specific product. Or "Loytec BACnet Devices" is 3 words. But they want the specific product name, not a vulnerability type. So I'll use "Loytec LIP-ME201C". Actually the description says "on LINX-A64", which is the platform. So maybe the product is "Loytec LINX-A64"? But the CPE list includes many products like l-inx, l-gate, etc. So it's a group of products. I could say "Loytec Automation Devices" but that's generic. I'll choose "Loytec LIP-ME201C" to be specific. 1-3 words: "Loytec LIP-ME201C" (3 words). That's fine. Summary: Must be 2-3 sentences, original synthesis. Start with impact verb and product. E.g., "Denial of service in Loytec LIP-ME201C and related building automation devices allows..." The impact: crash linx_a64.exe and reboot device. So it's a DoS that forces device reboot. WHO: unauthenticated remote attacker via malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with invalid month value. So "Denial of service in Loytec LI
Reflected Cross-Site Scripting in Loytec LWEB-802 versions prior to 5.0.8 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a crafted link containing malicious project or mspParams parameters. No active exploitation has been observed in the wild and EPSS indicates a low probability of exploitation (0.36%). Vendor has released a fix in version 5.0.8.
We need to output a JSON object with the specified fields. The input provides: CVE-2026-55729, description, CVSS 4.0 vector, EPSS, patch availability, tags, SSVC, ENISA, affected versions, references. We must synthesize. First, product_name: "Loytec LWEB-802" (1-3 words). It's a specific product: "LWEB-802". So "Loytec LWEB-802" fits (3 words). Yes. summary: Plain-language for security pros. Original synthesis, not copying description. Start with impact verb. Description says exposure of sensitive information, leaking stored management credentials via crafted link, unauthenticated remote attacker. Affected before 5.0.8 on all platforms. So: "Credential disclosure in Loytec LWEB-802 prior to 5.0.8 allows unauthenticated remote attackers to steal browser-stored management credentials through a malicious link." Mention EPSS 0.32% (low), no KEV, POC status unknown (not mentioned, but "no public exploit identified" since no POC tag? Tags: Information Disclosure, Lweb 802. SSVC: exploitation none. So active exploitation none. So: "No active exploitation reported, and EPSS score is low (0.32%), but the exposure is high-impact." And state CVSS 4.0 base score 7.7 (High). Also mention patch available. So: "Patched in version 5.0.8, with no known in-the-wild exploitation." No KEV, so not actively exploited. So summary: "Credential theft from browser local storage in Loytec LWEB-802 prior to version 5.0.8 enables remote unauthenticated attackers to exfiltrate stored management credentials by tricking a user into clicking a crafted link. The vulnerability has a low EPSS probability (0.32%) and no reported exploitation, but the CVSS 4.0 base score of 7.7 reflects high confidentiality, integrity, and availability impact on the vulnerable system." Keep concise. Since CVSS 4.0 vector is given, I'll note impact high. Actually, CVSS 4.0 vector: VC:H/VI:H/VA:H. So high impact to confidentiality, integrity, availability on vulnerable component. That is the browser's local storage? The
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
We need to produce a JSON object based on given instructions. Fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Input: CVE-2026-12503 description, CVSS 4.0 vector, EPSS 0.14% (low), tags, CPEs, SSVC: exploitation none, automatable no, technical impact total. References include Loytec advisory and NVD link. Also "Reported by: NCSC.ch". Affected versions from EUVD up to 8.4.16 on LINX-A64 (maybe specific platform?). Description: Improper Link Resolution (CWE-59) in /usr/bin/larm_starter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`. So local authenticated as larmapp user, requires ability to create symlink on that specific file. Attack leads to /etc/passwd becoming group-writable by larmapp group, then can add root account. So privilege escalation from larmapp to root. CVSS 4.0: AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N. PR:H means high privileges required (likely larmapp is a privileged user/group). However, description says "authenticated larmapp attacker". larmapp could be a low-privileged user? Wait: "larmapp" might be a service account, but the PR:H indicates high privileges needed. So the attacker already has larmapp privileges. Is larmapp high-privileged? Possibly a user with certain permissions. But we can use that vector as basis for assessment. SSVC says none exploitation, not automatable (no), total impact. EPSS low. So overall risk: local, high privileges, not currently exploited, not automatable, but leads to root. For risk assessment we can say it's a significant local privilege escalati
A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.
We need to produce a JSON with the specified fields. Data: CVE-2026-12496: Stored XSS in OPC XML-DA server statistics in multiple Loytec products through 8.4.16 on LINX-A64. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS 0.36% (low). CISA KEV not mentioned, no POC data explicitly? Input has no KEV status, Tags: XSS, etc. SSVC: Exploitation none, Automatable no, Technical Impact total. Affected versions: 0 <= 8.4.16 for all products. References: loytec advisory and NVD. No patch version given. Description says "through 8.4.16", so maybe 8.4.16 is the vulnerable ending version, but no fixed version. No exact fix version. Also, note: the CVE says "on LINX-A64", but the products are different. Probably these are Loytec building automation products. The vulnerability: unauthenticated remote attacker can inject stored XSS via User-Agent header in POST /da request, which executes in admin browser. So condition: OPC XML-DA server statistics accessed by admin. Possibly requires admin viewing the stats page. CVSS 4.0: UI:P (user interaction required to trigger), so the attack requires an admin to view the malicious data. AV:N, AC:L, PR:N, UI:P. So it's unauthenticated but requires user interaction (the admin viewing the page). Also, EPSS low, no active exploitation, no KEV. We need to construct all fields accordingly. No KEV, so "no public exploit identified at time of analysis" (since POC not mentioned either). No explicit POC data, so "no public exploit identified at time of analysis" (I'll use that). EPSS 0.36% is very low, so risk is low despite high impact. But stored XSS could lead to admin compromise, so high impact. product_name: Loytec LW-series? Actually products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. They are all Loytec building automation devices. I'll pick a representative, maybe "Loytec L-INX" or "Loytec L-GATE"? The CPE list includes lip-me20xc, l-inx, l-gate, etc. So product_name: "Loytec L-INX" (one of
Persistent denial of service in Loytec LIP-ME201C and related building automation controllers through version 8.4.16 allows unauthenticated remote attackers to cause CPU exhaustion via a crafted SNMP GETNEXT request with a large OID component. This vulnerability, tracked as CVE-2026-55731 and assigned CVSS 4.0 base score 6.6, has an EPSS exploitation probability of 0.32% and is not known to be actively exploited at analysis time.
Privilege escalation in Loytec ltsudo utility on LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through 8.4.16 allows a superadmin-group attacker to execute arbitrary code as root via a long interface-name argument to the cmd_ipaddr_conflict function. The vulnerability is a stack-based buffer overflow (CWE-121) in the SUID-root binary. No active exploitation or public exploit code identified at time of analysis.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpal_config.zml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.