CVE-2026-12496
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. An unauthenticated remote attacker can execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
Risk Assessment
Attackers can hijack the administrator's session, steal credentials, or perform unauthorized device reconfiguration, potentially leading to full compromise of the building automation system.
Recommendation
Update the firmware of Loytec products to a version later than 8.4.16 and apply HTTP header filtering.
Other vulnerabilities in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD
See all- CVE-2026-55732High
Out-of-bounds read vulnerability (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.18 on LINX-A64. An unauthenticated remote attacker can crash `linx_a64.exe` and ultimately reboot the device by sending a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value.
- CVE-2026-55728Low
A stack-based buffer overflow in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec devices (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) up to version 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.
- CVE-2026-12504High
Improper Authentication (CWE-287) in the PAM configuration in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. A local attacker can authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
- CVE-2026-12502High
Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. A `superadmin`-group attacker can reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
Original NVD description (English source)
Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.