CVE-2026-55728 Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict
A stack-based buffer overflow in Loytec LINX firmware allows superadmin users to cause denial of service or potentially escalate privileges via a long argument.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55728?
CVE-2026-55728 is a low-severity memory corruption vulnerability in Loytec L-DALI, published on 24 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.
Weakness: CWE-121
Which versions are affected by CVE-2026-55728?
How do I fix CVE-2026-55728?
No fix has been published for CVE-2026-55728 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-55728 being exploited?
There is no known exploitation of CVE-2026-55728 in the wild and no public exploit code.
Sources
Also known as GHSA-r7g9-r28w-w2pq.