CVE-2026-12504 Loytec CVE debrief

Who should care

Organizations using Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through version 8.4.16 on LINX-A64 should prioritize patching this vulnerability. Local attackers could exploit this vulnerability to gain unauthorized access with root privileges.

Technical summary

The vulnerability exists in the PAM configuration of affected Loytec products, including LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD, through version 8.4.16 on LINX-A64. An attacker can exploit this by creating an `/etc/passwd` entry with an empty password field, allowing authentication as uid=0 without a password. This could lead to a root shell being obtained by the attacker. The issue is related to CWE-287 (Improper Authentication) and CWE-521. A local attacker could leverage this vulnerability to gain unauthorized access with root privileges, emphasizing the need for prompt patching and additional monitoring of local authentication attempts.

Defensive priority

High priority should be given to patching this vulnerability due to its high CVSS score and the potential for local attackers to gain root access without a password.

Recommended defensive actions

• Apply the vendor-provided patch or update to a version beyond 8.4.16 for the affected Loytec products.
• Implement additional monitoring for local authentication attempts.
• Restrict access to sensitive configuration files like `/etc/passwd`.
• Consider using alternative authentication methods that do not rely solely on PAM configuration.
• Regularly review system logs for suspicious authentication attempts.

Evidence notes

The CVE record was published on 2026-07-24T15:17:11.157Z and last modified on 2026-07-27T20:32:11.620Z. The NVD entry is currently Deferred. A reference from [email protected] provides additional details about the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.