CVE-2026-12502 - Vulnerability Details - OpenCVE

Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.

Attack Vector Local

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

References

Link	Providers
https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-20260526-0001-unrestricted-service-account-password-reset-high

History

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
Title		Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo
Weaknesses		CWE-269
References		https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-20260526-0001-unrestricted-service-account-password-reset-high
Metrics		cvssV4_0 `{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: NCSC.ch

Published: 2026-07-24T13:57:44.001Z

Updated: 2026-07-24T14:58:22.991Z

Reserved: 2026-06-17T09:48:08.859Z

Link: CVE-2026-12502

Vulnrichment

Updated: 2026-07-24T14:58:14.685Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12502", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "state": "PUBLISHED", "assignerShortName": "NCSC.ch", "dateReserved": "2026-06-17T09:48:08.859Z", "datePublished": "2026-07-24T13:57:44.001Z", "dateUpdated": "2026-07-24T14:58:22.991Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-07-24T13:57:44.001Z"}, "title": "Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-269", "description": "CWE-269 Improper privilege management", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}, {"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "Loytec", "product": "LIP-ME20xC", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "8.4.16", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-INX", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "8.4.16", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-GATE", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "8.4.16", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-ROC", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "8.4.16", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-IOB", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "8.4.16", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-DALI", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "8.4.16", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-VIS", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "8.4.16", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-PAD", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "8.4.16", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper Privilege Management (CWE-269)\u00a0in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand."}]}], "references": [{"url": "https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-20260526-0001-unrestricted-service-account-password-reset-high", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to firmware version 8.4.18.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to firmware version 8.4.18."}]}], "credits": [{"lang": "en", "value": "Daniel Hulliger, armasuisse CYD Campus", "type": "finder"}, {"lang": "en", "value": "Damian Pfammatter, armasuisse CYD Campus", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-24T14:58:09.849263Z", "id": "CVE-2026-12502", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T14:58:22.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12502", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-24T14:58:09.849263Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T14:58:14.685Z"}}], "cna": {"title": "Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Daniel Hulliger, armasuisse CYD Campus"}, {"lang": "en", "type": "finder", "value": "Damian Pfammatter, armasuisse CYD Campus"}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}, {"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Loytec", "product": "LIP-ME20xC", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.4.16"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-INX", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.4.16"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-GATE", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.4.16"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-ROC", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.4.16"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-IOB", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.4.16"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-DALI", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.4.16"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-VIS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.4.16"}], "defaultStatus": "unaffected"}, {"vendor": "Loytec", "product": "L-PAD", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.4.16"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to firmware version 8.4.18.", "supportingMedia": [{"type": "text/html", "value": "Upgrade to firmware version 8.4.18.", "base64": false}]}], "references": [{"url": "https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-20260526-0001-unrestricted-service-account-password-reset-high", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Improper Privilege Management (CWE-269)\u00a0in `/usr/bin/ltsudo` in Loytec LIP-ME201C,\u00a0L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.", "supportingMedia": [{"type": "text/html", "value": "Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper privilege management"}]}], "providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-07-24T13:57:44.001Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12502", "state": "PUBLISHED", "dateUpdated": "2026-07-24T14:58:22.991Z", "dateReserved": "2026-06-17T09:48:08.859Z", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "datePublished": "2026-07-24T13:57:44.001Z", "assignerShortName": "NCSC.ch"}, "dataVersion": "5.2"}