CVE-2026-55730

HighCVSS 8.7

Published: 24/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before version 5.0.8 on all platforms. An unauthenticated remote attacker can execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious `project` or `mspParams` parameter.

Risk Assessment

Attackers can hijack the victim's session, steal credentials, or perform unauthorized actions in the LWEB-802 system.

Recommendation

Immediately upgrade LWEB-802 to version 5.0.8 or later.

Other vulnerabilities in LWEB-802

CVE-2026-55729High
Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before version 5.0.8 on all platforms. An unauthenticated remote attacker can leak stored management credentials via a crafted link.

Original NVD description (English source)

Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious `project` or `mspParams` parameter.