Back to overview

CVE-2026-12503

CRITICAL
9.2
CVSS 4.0
Description
Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.

Metadata

CVE ID
CVE-2026-12503
State
PUBLISHED
Assigner
NCSC.ch
Reserved
2026-06-17 09:48 UTC
Published
2026-07-24 13:57 UTC
Last updated
2026-07-24 14:57 UTC
Primary CWE
CWE-59
CWE-59 Improper link resolution before file access ('link fo…
Vendor / Product
Loytec / LIP-ME20xC
Sources
cve.org  ·  NVD

Severity & Metrics

9.2 CRITICAL CVSS 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (8)
VendorProductPlatformVersions
Loytec L-DALI — 0 ≤ 8.4.16
Loytec L-GATE — 0 ≤ 8.4.16
Loytec L-INX — 0 ≤ 8.4.16
Loytec L-IOB — 0 ≤ 8.4.16
Loytec L-PAD — 0 ≤ 8.4.16
Loytec L-ROC — 0 ≤ 8.4.16
Loytec L-VIS — 0 ≤ 8.4.16
Loytec LIP-ME20xC — 0 ≤ 8.4.16
Weakness (CWE)
CWESourceDescription
CWE-59 cna CWE-59 Improper link resolution before file access ('link following')
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.2 CRITICAL 4.0 cna CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N
References (1)
Back to overview