Loytec vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-55732 Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD throuHigh 8.7 · Jul 24, 2026
• CVE-2026-55730 Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitraHigh 8.7 · Jul 24, 2026
• CVE-2026-55729 Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote High 7.7 · Jul 24, 2026
• CVE-2026-12504 Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64High 8.4 · Jul 24, 2026
• CVE-2026-12503 Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows anCritical 9.2 · Jul 24, 2026
• CVE-2026-12502 Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-AHigh 8.4 · Jul 24, 2026
• CVE-2026-12496 Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.High 8.7 · Jul 24, 2026
• CVE-2023-46389 LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via registry.xml file.High 7.5 · Nov 30, 2023
• CVE-2023-46388 LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_config.zml file.High 7.5 · Nov 30, 2023
• CVE-2023-46387 LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpal_config.zml file.High 7.5 · Nov 30, 2023
• CVE-2023-46386 LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registry.xml file.High 7.5 · Nov 30, 2023
• CVE-2023-46385 LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions.High 7.5 · Nov 30, 2023
• CVE-2023-46384 LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions.High 7.5 · Nov 30, 2023
• CVE-2023-46383 LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext andHigh 7.5 · Nov 30, 2023
• CVE-2023-46382 LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login.High 7.5 · Nov 4, 2023
• CVE-2023-46381 LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled veHigh 8.2 · Nov 4, 2023
• CVE-2023-46380 LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartextHigh 7.5 · Nov 4, 2023
• CVE-2018-14918 LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal.High 7.5 · Jun 28, 2019
• CVE-2018-14916 LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion.Critical 9.1 · Jun 28, 2019
• CVE-2017-13998 An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0.High 7.5 · Oct 5, 2017
• CVE-2017-13996 A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0.High 8.8 · Oct 5, 2017
• CVE-2017-13992 An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0.High 8.1 · Oct 5, 2017
• CVE-2015-7906 LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors.High 10 · Dec 21, 2015