CVE-2026-12503criticalCWE-59

CVE-2026-12503: falha crítica em Loytec L-INX

Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter

Publicada em

Seguir esta CVE+ Monitorar L-DALI+ Monitorar L-GATE

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.2%
Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N
Produtos afetados
Loytec · L-DALILoytec · L-GATELoytec · L-INXLoytec · L-IOBLoytec · LIP-ME20xCLoytec · L-PADLoytec · L-ROCLoytec · L-VIS
CVEs relacionadas — Loytec L-INX

No mesmo produto, das mais perigosas para as menos.

CVE-2026-12496HIGHLoytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA serverEPSS 0.6%CVE-2026-55732HIGHLoytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)EPSS 0.5%CVE-2026-55731MEDIUMLoytec LINX firmware: Unchecked input for loop condition in the SNMP agentEPSS 0.5%CVE-2026-12504HIGHLoytec LINX firmware: Improper Authentication in PAM configurationEPSS 0.2%CVE-2026-55728LOWLoytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflictEPSS 0.2%CVE-2026-12502HIGHLoytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudoEPSS 0.2%