CVE-2026-55728
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A stack-based buffer overflow in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec devices (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) up to version 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.
Risk Assessment
The risk is privilege escalation by a superadmin-group attacker, potentially leading to full device compromise and access to critical control systems.
Recommendation
Immediately update Loytec device firmware to a version newer than 8.4.16 and restrict superadmin group access to trusted users only.
Original NVD description (English source)
Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.