Loytec
Monthly
Reflected Cross-Site Scripting in Loytec LWEB-802 versions prior to 5.0.8 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a crafted link containing malicious project or mspParams parameters. No active exploitation has been observed in the wild and EPSS indicates a low probability of exploitation (0.36%). Vendor has released a fix in version 5.0.8.
Credential exposure in the Loytec LWEB-802 browser-based management interface allows an unauthenticated remote attacker to steal management credentials stored in the browser's localStorage by tricking a logged-in user into clicking a crafted link. All platforms running LWEB-802 before version 5.0.8 are affected. Because the stolen credentials provide full access to the building automation management system, SSVC rates the technical impact as total - meaning successful exploitation effectively hands an attacker complete control over the managed facility systems.
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.
Persistent denial of service in Loytec LIP-ME201C and related building automation controllers through version 8.4.16 allows unauthenticated remote attackers to cause CPU exhaustion via a crafted SNMP GETNEXT request with a large OID component. This vulnerability, tracked as CVE-2026-55731 and assigned CVSS 4.0 base score 6.6, has an EPSS exploitation probability of 0.32% and is not known to be actively exploited at analysis time.
Privilege escalation in Loytec ltsudo utility on LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through 8.4.16 allows a superadmin-group attacker to execute arbitrary code as root via a long interface-name argument to the cmd_ipaddr_conflict function. The vulnerability is a stack-based buffer overflow (CWE-121) in the SUID-root binary. No active exploitation or public exploit code identified at time of analysis.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpal_config.zml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Reflected Cross-Site Scripting in Loytec LWEB-802 versions prior to 5.0.8 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a crafted link containing malicious project or mspParams parameters. No active exploitation has been observed in the wild and EPSS indicates a low probability of exploitation (0.36%). Vendor has released a fix in version 5.0.8.
Credential exposure in the Loytec LWEB-802 browser-based management interface allows an unauthenticated remote attacker to steal management credentials stored in the browser's localStorage by tricking a logged-in user into clicking a crafted link. All platforms running LWEB-802 before version 5.0.8 are affected. Because the stolen credentials provide full access to the building automation management system, SSVC rates the technical impact as total - meaning successful exploitation effectively hands an attacker complete control over the managed facility systems.
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.
Persistent denial of service in Loytec LIP-ME201C and related building automation controllers through version 8.4.16 allows unauthenticated remote attackers to cause CPU exhaustion via a crafted SNMP GETNEXT request with a large OID component. This vulnerability, tracked as CVE-2026-55731 and assigned CVSS 4.0 base score 6.6, has an EPSS exploitation probability of 0.32% and is not known to be actively exploited at analysis time.
Privilege escalation in Loytec ltsudo utility on LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through 8.4.16 allows a superadmin-group attacker to execute arbitrary code as root via a long interface-name argument to the cmd_ipaddr_conflict function. The vulnerability is a stack-based buffer overflow (CWE-121) in the SUID-root binary. No active exploitation or public exploit code identified at time of analysis.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpal_config.zml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled version of LWEB-802 via an lweb802_pre/. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartext HTTP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.