CVE-2026-55729

HighCVSS 7.7

Published: 24/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before version 5.0.8 on all platforms. An unauthenticated remote attacker can leak stored management credentials via a crafted link.

Risk Assessment

Attackers can obtain administrator credentials for the LWEB-802 system, potentially leading to full system compromise.

Recommendation

Immediately upgrade LWEB-802 to version 5.0.8 or later.

Other vulnerabilities in LWEB-802

CVE-2026-55730High
Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before version 5.0.8 on all platforms. An unauthenticated remote attacker can execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious `project` or `mspParams` parameter.

Original NVD description (English source)

Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link.