Vulnerability in Loytec L-Dali
CVE-2026-12503
Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.
EPSS: 0.001 (3.3th percentile) — read the EPSS interpretation.
Affected products
- Loytec L-dali — versions 0
- Loytec L-gate — versions 0
- Loytec L-inx — versions 0
- Loytec L-iob — versions 0
- Loytec Lip-me20xc — versions 0
- Loytec L-pad — versions 0
- Loytec L-roc — versions 0
- Loytec L-vis — versions 0
Weakness classification (CWE)
References
- vulnerability@ncsc.ch (vendor-advisory)