CVE-2026-12503

Summary

Improper Link Resolution (CWE-59) in /usr/bin/larm_starter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated larmapp attacker to make /etc/passwd writable by the larmapp group (leading to root privilege escalation) via a symlink attack on /etc/lighttpd/ssl/server.pem.

Affected Software

VendorProductVersion RangeStatus
LoytecLIP-ME20xC0 <= 8.4.16affected
LoytecL-INX0 <= 8.4.16affected
LoytecL-GATE0 <= 8.4.16affected
LoytecL-ROC0 <= 8.4.16affected
LoytecL-IOB0 <= 8.4.16affected
LoytecL-DALI0 <= 8.4.16affected
LoytecL-VIS0 <= 8.4.16affected
LoytecL-PAD0 <= 8.4.16affected

Weaknesses

  • CWE-59: CWE-59 Improper link resolution before file access ('link following')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References