CVE-2026-55732
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Out-of-bounds read vulnerability (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.18 on LINX-A64. An unauthenticated remote attacker can crash `linx_a64.exe` and ultimately reboot the device by sending a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value.
Risk Assessment
This vulnerability allows remote denial-of-service (DoS) attacks on Loytec devices, potentially disrupting building automation systems.
Recommendation
Update the firmware of Loytec products to a version later than 8.4.18 and apply network filters to restrict access to BACnet ports.
Other vulnerabilities in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD
See all- CVE-2026-55728Low
A stack-based buffer overflow in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec devices (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) up to version 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.
- CVE-2026-12504High
Improper Authentication (CWE-287) in the PAM configuration in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. A local attacker can authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
- CVE-2026-12502High
Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. A `superadmin`-group attacker can reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
- CVE-2026-12496High
Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. An unauthenticated remote attacker can execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
Original NVD description (English source)
Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products.