# CVE-2026-12502: Loytec Multiple Products privilege escalation in ltsudo

Source: https://junglewise.ai/threats/cve-2026-12502-loytec-multiple-products-privilege-escalation-in-ltsudo  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-12502 · Severity: info · CVSS 8.4 · Published 2026-07-24

A vulnerability in several Loytec building automation and control devices allows a user with high-level administrative privileges to reset the password of any other account, including critical service accounts. This could allow an administrator to take full control of the system or impersonate service accounts used for automated building operations. This risk impacts the integrity and availability of building management systems such as lighting, climate control, and security interfaces.

Technologies: [LOYTEC L-DALI](https://junglewise.ai/threats/technologies/l-dali), [LOYTEC L-GATE](https://junglewise.ai/threats/technologies/l-gate), [LOYTEC L-INX](https://junglewise.ai/threats/technologies/l-inx), [LOYTEC L-IOB](https://junglewise.ai/threats/technologies/l-iob), [LOYTEC L-PAD](https://junglewise.ai/threats/technologies/l-pad), [LOYTEC L-ROC](https://junglewise.ai/threats/technologies/l-roc), [LOYTEC L-VIS](https://junglewise.ai/threats/technologies/l-vis), [LOYTEC LIP-ME201C](https://junglewise.ai/threats/technologies/lip-me201c). Vendors: [LOYTEC](https://junglewise.ai/threats/vendors/loytec).

## Quick answers

**Is CVE-2026-12502 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12502 being exploited in the wild.

**How severe is CVE-2026-12502?** Informational severity, with a CVSS score of 8.4, published 24 July 2026.

**Which products and versions are affected?** LOYTEC L-DALI through 8.4.16; LOYTEC L-GATE through 8.4.16; LOYTEC L-INX through 8.4.16; LOYTEC L-IOB through 8.4.16; and 4 more.

**Is there a fix for CVE-2026-12502?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12502 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-12502?** Check whether you run LOYTEC L-DALI, LOYTEC L-GATE, LOYTEC L-INX or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper privilege management vulnerability (CWE-269) exists in the '/usr/bin/ltsudo' utility on Loytec devices running on the LINX-A64 platform. The 'set-passwd' subcommand fails to perform adequate authorization checks, allowing a user in the 'superadmin' group to reset the password of any LARM user, including the 'larmapp' service account, by providing user:password pairs via stdin. An attacker with local access and superadmin privileges can exploit this to impersonate service accounts or other users. The issue is addressed in firmware version 8.4.18.

## Affected products

- Loytec LIP-ME201C through 8.4.16
- Loytec L-INX through 8.4.16
- Loytec L-GATE through 8.4.16
- Loytec L-ROC through 8.4.16
- Loytec L-IOB through 8.4.16
- Loytec L-DALI through 8.4.16
- Loytec L-VIS through 8.4.16
- Loytec L-PAD through 8.4.16

## Timeline

- 2026-07-24: advisory: NVD publication date
- 2026-07-24: disclosed: Initial disclosure by Switzerland Government Common Vulnerability Program

## References

- [https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-20260526-0001-unrestricted-service-account-password-reset-high](https://www.loytec.com/support/product-security/advisories/8519-dibt-cve-20260526-0001-unrestricted-service-account-password-reset-high)

## Related threats

- [Loytec BACnet devices out-of-bounds read in bacdt_datetime_to_tod](https://junglewise.ai/threats/cve-2026-55732-loytec-bacnet-devices-out-of-bounds-read-in-bacdt-datetime-to-tod)
- [Loytec Multiple Products DoS via SNMP Agent CPU Exhaustion](https://junglewise.ai/threats/cve-2026-55731-loytec-multiple-products-dos-via-snmp-agent-cpu-exhaustion)
- [Loytec Multiple Products stack overflow in ltsudo](https://junglewise.ai/threats/cve-2026-55728-loytec-multiple-products-stack-overflow-in-ltsudo)
- [Loytec Building Automation Devices Improper Authentication in PAM](https://junglewise.ai/threats/cve-2026-12504-loytec-building-automation-devices-improper-authentication-in-pam)
- [Loytec Multiple Products Stored XSS in OPC XML-DA Server Statistics](https://junglewise.ai/threats/cve-2026-12496-loytec-multiple-products-stored-xss-in-opc-xml-da-server)