TI-2026-40230 Aliases CVE-2026-55732 GHSA-6jqh-rgp9-536f

Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)

MEDIUM 44CWE-125Published 2026-07-24 · Updated 2026-07-24

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00544 45th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Loytec	LIP-ME20xC	up to 8.4.18	—	No fix listed	CNA
Loytec	L-INX	up to 8.4.18	—	No fix listed	CNA
Loytec	L-GATE	up to 8.4.18	—	No fix listed	CNA
Loytec	L-ROC	up to 8.4.18	—	No fix listed	CNA
Loytec	L-IOB	up to 8.4.18	—	No fix listed	CNA
Loytec	L-DALI	up to 8.4.18	—	No fix listed	CNA
Loytec	L-VIS	up to 8.4.18	—	No fix listed	CNA
Loytec	L-PAD	up to 8.4.18	—	No fix listed	CNA

LIP-ME20xC VendorLoytec Affected up to 8.4.18 Fixed in — No fix listed CNA
L-INX VendorLoytec Affected up to 8.4.18 Fixed in — No fix listed CNA
L-GATE VendorLoytec Affected up to 8.4.18 Fixed in — No fix listed CNA
L-ROC VendorLoytec Affected up to 8.4.18 Fixed in — No fix listed CNA
L-IOB VendorLoytec Affected up to 8.4.18 Fixed in — No fix listed CNA
L-DALI VendorLoytec Affected up to 8.4.18 Fixed in — No fix listed CNA
L-VIS VendorLoytec Affected up to 8.4.18 Fixed in — No fix listed CNA
L-PAD VendorLoytec Affected up to 8.4.18 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-55732
2026-10-03 Alias added: GHSA-6jqh-rgp9-536f

References

Advisory 1

https://www.loytec.com/support/product-security/advisories/8532-dibt-cve-20260608-0001-bacnet-crash-due-to-invalid-timesync-message-high

TI-2018-10727 LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion. CVSS 3.0CRITICAL 9.1
TI-2023-24969 LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX… CVSS 3.1HIGH 8.2
TI-2018-10728 LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal. CVSS 3.0HIGH 7.5
TI-2026-40228 Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802 CVSS 4.0HIGH 8.7
TI-2015-06575 LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote… CVSS 2.0HIGH 10.0
TI-2023-24968 LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX… CVSS 3.1HIGH 7.5

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences