Description
Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.
Published: 2026-07-24
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper Link Resolution (CWE-59) in /usr/bin/larm_starter allows an authenticated larmapp user to create a malicious symlink at /etc/lighttpd/ssl/server.pem. When the application follows the symlink, it writes to /etc/passwd, effectively giving the attacker root privileges.

Affected Systems

The affected devices are Loytec LINX system firmware for L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD running firmware versions up to and including 8.4.16 on the LINX-A64 platform.

Risk and Exploitability

The CVSS score of 9.2 indicates critical severity, while the EPSS score of less than 1% suggests low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; it requires an attacker to be authenticated as larmapp and to have permission to create the symlink in /etc/lighttpd/ssl.

Generated by OpenCVE AI on August 3, 2026 at 20:17 UTC.

Remediation

Vendor Solution

Upgrade to firmware 8.4.18.

OpenCVE Recommended Actions

  • Apply the official firmware upgrade to version 8.4.18.
  • Restrict the /etc/lighttpd/ssl directory so that only root can create or modify files, preventing the larmapp group from creating symlinks.
  • Verify that /etc/lighttpd/ssl/server.pem is a regular file and not a symlink.

Generated by OpenCVE AI on August 3, 2026 at 20:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Loytec
Loytec l-dali
Loytec l-gate
Loytec l-inx
Loytec l-iob
Loytec l-pad
Loytec l-roc
Loytec l-vis
Loytec lip-me20xc
Vendors & Products Loytec
Loytec l-dali
Loytec l-gate
Loytec l-inx
Loytec l-iob
Loytec l-pad
Loytec l-roc
Loytec l-vis
Loytec lip-me20xc

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Description Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.
Title Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter
Weaknesses CWE-59
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Loytec L-dali L-gate L-inx L-iob L-pad L-roc L-vis Lip-me20xc
cve-icon MITRE

Status: PUBLISHED

Assigner: NCSC.ch

Published:

Updated: 2026-07-24T14:57:47.202Z

Reserved: 2026-06-17T09:48:11.206Z

Link: CVE-2026-12503

cve-icon Vulnrichment

Updated: 2026-07-24T14:57:41.733Z

cve-icon NVD

Status : Deferred

Published: 2026-07-24T15:17:10.997

Modified: 2026-07-27T20:32:11.620

Link: CVE-2026-12503

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T20:30:04Z

Weaknesses
  • CWE-59

    Improper Link Resolution Before File Access ('Link Following')