Record status Published
Identifier year (not publication year) 2026
Source publication Jul 24, 2026
Source updated Jul 24, 2026
Imported by cveboard Oct 24, 2026
CNA source text (English) Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server
Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
Scoped product and version facts Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
LIP-ME20xC
Vendor Loytec
Product LIP-ME20xC
Platforms Unknown
Default status unaffected
LIP-ME20xC · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom Unavailable 8.4.16 None listed
L-INX
Vendor Loytec
Product L-INX
Platforms Unknown
Default status unaffected
L-INX · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom Unavailable 8.4.16 None listed
L-GATE
Vendor Loytec
Product L-GATE
Platforms Unknown
Default status unaffected
L-GATE · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom Unavailable 8.4.16 None listed
L-ROC
Vendor Loytec
Product L-ROC
Platforms Unknown
Default status unaffected
L-ROC · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom Unavailable 8.4.16 None listed
L-IOB
Vendor Loytec
Product L-IOB
Platforms Unknown
Default status unaffected
L-IOB · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom Unavailable 8.4.16 None listed
L-DALI
Vendor Loytec
Product L-DALI
Platforms Unknown
Default status unaffected
L-DALI · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom Unavailable 8.4.16 None listed
L-VIS
Vendor Loytec
Product L-VIS
Platforms Unknown
Default status unaffected
L-VIS · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom Unavailable 8.4.16 None listed
L-PAD
Vendor Loytec
Product L-PAD
Platforms Unknown
Default status unaffected
L-PAD · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedcustom Unavailable 8.4.16 None listed