CVE-2026-12502 Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo
A superadmin user can reset passwords for any LARM user, including service accounts, leading to privilege escalation and account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12502?
CVE-2026-12502 is a high-severity vulnerability in Loytec L-DALI, published on 24 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
Weakness: CWE-269
Which versions are affected by CVE-2026-12502?
How do I fix CVE-2026-12502?
No fix has been published for CVE-2026-12502 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-12502 being exploited?
There is no known exploitation of CVE-2026-12502 in the wild and no public exploit code.
Sources
Also known as GHSA-x5vq-r47f-779j.