Read the docs
TI-2026-40227 Aliases CVE-2026-55729GHSA-c4x3-39wp-wf7p

Loytec LWEB802: Exposure of Sensitive Information in browser localStorage

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00544 45th percentileScored 2026-11-07
Fix Fixed LWEB-802 (Loytec): 5.0.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LoytecLWEB-802before 5.0.85.0.8Patch availableCNA
  • LWEB-802 VendorLoytec Affected before 5.0.8 Fixed in 5.0.8 Patch available CNA

Remediation

  • Fix · CNA LWEB-802 (Loytec) Fixed in 5.0.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Loytec LWEB-802 5.0.8

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-40228 Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802Priority MEDIUM 47
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55729
  2. 2026-10-03 Alias added: GHSA-c4x3-39wp-wf7p

References

Advisory 1

  • TI-2018-10727 LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion. CVSS 3.0CRITICAL 9.1
  • TI-2023-24969 LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX… CVSS 3.1HIGH 8.2
  • TI-2018-10728 LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal. CVSS 3.0HIGH 7.5
  • TI-2026-40228 Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802 CVSS 4.0HIGH 8.7
  • TI-2015-06575 LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote… CVSS 2.0HIGH 10.0
  • TI-2026-40230 Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod) CVSS 4.0HIGH 8.7
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences