Executive brief
A security vulnerability exists in several Loytec building automation and control devices, including L-INX, L-GATE, and L-ROC series. An attacker with existing access to the device can manipulate system files to gain full administrative (root) control. This could allow an unauthorized user to disrupt building operations, modify configurations, or compromise the security of the connected automation network.
Technical details
An improper link resolution (CWE-59) vulnerability exists in the `/usr/bin/larm_starter` component of Loytec firmware through version 8.4.16. The root cause is the `set_perm()` function, which executes `chown` and `chmod` operations without the `-h` (no-dereference) flag. An authenticated attacker with `larmapp` group privileges can create a symbolic link at `/etc/lighttpd/ssl/server.pem` pointing to `/etc/passwd`. When the system updates permissions, it follows the link and makes the system password file writable by the `larmapp` group, enabling full root privilege escalation. The issue is resolved in firmware version 8.4.18.
Affected products
- Loytec L-INX Automation Servers through 8.4.16
- Loytec L-GATE Gateways through 8.4.16
- Loytec L-ROC Room Automation through 8.4.16
- Loytec L-IOB I/O Controllers through 8.4.16
- Loytec L-DALI Lighting Control through 8.4.16
- Loytec L-VIS Touch Panels through 8.4.16
- Loytec L-PAD Touch Panels through 8.4.16
- Loytec LIP-ME20xC through 8.4.16
Timeline
- 2026-07-24: advisory: NVD and vendor advisory published