Read the docs
TI-2026-40228 Aliases CVE-2026-55730GHSA-8c38-mwr2-hj5c

Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802

Priority MEDIUM 47CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious `project` or `mspParams` parameter.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00606 49th percentileScored 2026-11-07
Fix Fixed LWEB-802 (Loytec): 5.0.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LoytecLWEB-802before 5.0.85.0.8Patch availableCNA
  • LWEB-802 VendorLoytec Affected before 5.0.8 Fixed in 5.0.8 Patch available CNA

Remediation

  • Fix · CNA LWEB-802 (Loytec) Fixed in 5.0.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Loytec LWEB-802 5.0.8

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-40227 Loytec LWEB802: Exposure of Sensitive Information in browser localStoragePriority LOW 36
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55730
  2. 2026-10-03 Alias added: GHSA-8c38-mwr2-hj5c

References

Advisory 1

  • TI-2018-10727 LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion. CVSS 3.0CRITICAL 9.1
  • TI-2023-24969 LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX… CVSS 3.1HIGH 8.2
  • TI-2018-10728 LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal. CVSS 3.0HIGH 7.5
  • TI-2015-06575 LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote… CVSS 2.0HIGH 10.0
  • TI-2026-40230 Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod) CVSS 4.0HIGH 8.7
  • TI-2023-24968 LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX… CVSS 3.1HIGH 7.5
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences