Is CVE-2026-12503 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12503 being exploited in the wild.

How severe is CVE-2026-12503?

Informational severity, with a CVSS score of 9.2, published 24 July 2026.

Which products and versions are affected?

LOYTEC L-DALI Lighting Control through 8.4.16; LOYTEC L-GATE Gateways through 8.4.16; LOYTEC L-INX Automation Servers through 8.4.16; LOYTEC L-IOB I/O Controllers through 8.4.16; and 4 more.

Is there a fix for CVE-2026-12503?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12503 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-12503?

Check whether you run LOYTEC L-DALI Lighting Control, LOYTEC L-GATE Gateways, LOYTEC L-INX Automation Servers or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12503: Loytec Building Automation Products privilege escalation in larm_starter

CVE-2026-12503 · Severity: info · CVSS 9.2 · Published 2026-07-24

A security vulnerability exists in several Loytec building automation and control devices, including L-INX, L-GATE, and L-ROC series. An attacker with existing access to the device can manipulate system files to gain full administrative (root) control. This could allow an unauthorized user to disrupt building operations, modify configurations, or compromise the security of the connected automation network.

Vendors: LOYTEC.

Quick answers

Is CVE-2026-12503 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12503 being exploited in the wild.
How severe is CVE-2026-12503?: Informational severity, with a CVSS score of 9.2, published 24 July 2026.
Which products and versions are affected?: LOYTEC L-DALI Lighting Control through 8.4.16; LOYTEC L-GATE Gateways through 8.4.16; LOYTEC L-INX Automation Servers through 8.4.16; LOYTEC L-IOB I/O Controllers through 8.4.16; and 4 more.
Is there a fix for CVE-2026-12503?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12503 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-12503?: Check whether you run LOYTEC L-DALI Lighting Control, LOYTEC L-GATE Gateways, LOYTEC L-INX Automation Servers or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper link resolution (CWE-59) vulnerability exists in the `/usr/bin/larm_starter` component of Loytec firmware through version 8.4.16. The root cause is the `set_perm()` function, which executes `chown` and `chmod` operations without the `-h` (no-dereference) flag. An authenticated attacker with `larmapp` group privileges can create a symbolic link at `/etc/lighttpd/ssl/server.pem` pointing to `/etc/passwd`. When the system updates permissions, it follows the link and makes the system password file writable by the `larmapp` group, enabling full root privilege escalation. The issue is resolved in firmware version 8.4.18.

Affected products

Loytec L-INX Automation Servers through 8.4.16
Loytec L-GATE Gateways through 8.4.16
Loytec L-ROC Room Automation through 8.4.16
Loytec L-IOB I/O Controllers through 8.4.16
Loytec L-DALI Lighting Control through 8.4.16
Loytec L-VIS Touch Panels through 8.4.16
Loytec L-PAD Touch Panels through 8.4.16
Loytec LIP-ME20xC through 8.4.16

Timeline

2026-07-24: advisory: NVD and vendor advisory published

References

https://www.loytec.com/support/product-security/advisories/8520-dibt-cve-20260526-0002-symlink-following-in-chown-chmod-critical

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.