CVE-2026-12503
An improper link resolution flaw in Loytec’s L‑INX, L‑GATE, L‑ROC, L‑IOB, L‑DALI, L‑VIS and L‑PAD devices (up to version 8.4.16 on LINX‑A64) lets an authenticated user create a symlink that makes the system file \/etc\/passwd writable. This can be used to add or modify user accounts and ultimately gain root privileges.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Loytec L‑INX, L‑GATE, L‑ROC, L‑IOB, L‑DALI, L‑VIS and L‑PAD devices running firmware up to 8.4.16 on the LINX‑A64 platform. The typical user is an administrator or operator of these devices.
Real-world impact
An attacker who can log in as the larmapp user could modify the system’s password file, add a new root account or change existing passwords, giving them full control over the device and any connected systems.
Why this severity
The CVSS score of 9.2 reflects a local attack that requires the attacker to be authenticated as larmapp, but the impact is very high: the flaw allows full compromise of confidentiality, integrity, and availability, and can lead to complete system takeover.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 24, 2026 · 8d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 4d agoAdvisory updatedThe NVD record was last revised.