CVE-2026-12502
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. A `superadmin`-group attacker can reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
Risk Assessment
An attacker with superadmin privileges can take over other LARM user accounts, including the service account, potentially leading to privilege escalation and further system compromise.
Recommendation
Update the firmware of Loytec products to a version later than 8.4.16 and review superadmin group permissions.
Other vulnerabilities in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD
See all- CVE-2026-55732High
Out-of-bounds read vulnerability (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.18 on LINX-A64. An unauthenticated remote attacker can crash `linx_a64.exe` and ultimately reboot the device by sending a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value.
- CVE-2026-55728Low
A stack-based buffer overflow in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec devices (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) up to version 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.
- CVE-2026-12504High
Improper Authentication (CWE-287) in the PAM configuration in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. A local attacker can authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
- CVE-2026-12496High
Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. An unauthenticated remote attacker can execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
Original NVD description (English source)
Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.