Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-55732

Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
NCSC.ch

Description

Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Loytec LIP-ME20xC

Default version status: unaffected

  • 0 to ≤ 8.4.18affected

Loytec L-INX

Default version status: unaffected

  • 0 to ≤ 8.4.18affected

Loytec L-GATE

Default version status: unaffected

  • 0 to ≤ 8.4.18affected

Loytec L-ROC

Default version status: unaffected

  • 0 to ≤ 8.4.18affected

Loytec L-IOB

Default version status: unaffected

  • 0 to ≤ 8.4.18affected

Loytec L-DALI

Default version status: unaffected

  • 0 to ≤ 8.4.18affected

Loytec L-VIS

Default version status: unaffected

  • 0 to ≤ 8.4.18affected

Loytec L-PAD

Default version status: unaffected

  • 0 to ≤ 8.4.18affected

References