CVE-2026-12504
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Improper Authentication (CWE-287) in the PAM configuration in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. A local attacker can authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
Risk Assessment
An attacker with local access can gain full root control over the device, enabling malware installation, configuration modification, and access to sensitive data.
Recommendation
Update the firmware of Loytec products to a version later than 8.4.16 and harden the PAM configuration.
Other vulnerabilities in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD
See all- CVE-2026-55732High
Out-of-bounds read vulnerability (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.18 on LINX-A64. An unauthenticated remote attacker can crash `linx_a64.exe` and ultimately reboot the device by sending a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value.
- CVE-2026-55728Low
A stack-based buffer overflow in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec devices (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) up to version 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.
- CVE-2026-12502High
Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. A `superadmin`-group attacker can reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
- CVE-2026-12496High
Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. An unauthenticated remote attacker can execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
Original NVD description (English source)
Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.