Is CVE-2026-12504 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12504 being exploited in the wild.

How severe is CVE-2026-12504?

Informational severity, with a CVSS score of 8.4, published 24 July 2026.

Which products and versions are affected?

LOYTEC L-DALI through 8.4.16; LOYTEC L-GATE through 8.4.16; LOYTEC L-INX through 8.4.16; LOYTEC L-IOB through 8.4.16; and 4 more.

Is there a fix for CVE-2026-12504?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12504 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-12504?

Check whether you run LOYTEC L-DALI, LOYTEC L-GATE, LOYTEC L-INX or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12504: Loytec Building Automation Devices Improper Authentication in PAM

CVE-2026-12504 · Severity: info · CVSS 8.4 · Published 2026-07-24

Loytec building automation devices, including touch panels and lighting controllers, contain a security flaw in their authentication configuration. An attacker who already has limited access to the device can exploit this to gain full administrative (root) control without a password. This could allow an unauthorized user to disrupt building operations, modify system settings, or access sensitive data.

Technologies: LOYTEC L-DALI, LOYTEC L-GATE, LOYTEC L-INX, LOYTEC L-IOB, LOYTEC L-PAD, LOYTEC L-ROC, LOYTEC L-VIS, LOYTEC LIP-ME201C. Vendors: LOYTEC.

Quick answers

Is CVE-2026-12504 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12504 being exploited in the wild.
How severe is CVE-2026-12504?: Informational severity, with a CVSS score of 8.4, published 24 July 2026.
Which products and versions are affected?: LOYTEC L-DALI through 8.4.16; LOYTEC L-GATE through 8.4.16; LOYTEC L-INX through 8.4.16; LOYTEC L-IOB through 8.4.16; and 4 more.
Is there a fix for CVE-2026-12504?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12504 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-12504?: Check whether you run LOYTEC L-DALI, LOYTEC L-GATE, LOYTEC L-INX or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Pluggable Authentication Module (PAM) configuration of several Loytec building automation products. The configuration utilizes 'pam_unix.so' with the 'nullok' option enabled. A local attacker with the ability to modify or append entries to the '/etc/passwd' file can create a new account with a UID of 0 and an empty password field. By then using the 'su' command, the attacker can authenticate as that user without providing a password, effectively obtaining a root shell. This issue affects multiple product lines on the LINX-A64 platform through firmware version 8.4.16. Users are advised to upgrade to firmware version 8.4.18.

Affected products

Loytec LIP-ME201C through 8.4.16
Loytec L-INX through 8.4.16
Loytec L-GATE through 8.4.16
Loytec L-ROC through 8.4.16
Loytec L-IOB through 8.4.16
Loytec L-DALI through 8.4.16
Loytec L-VIS through 8.4.16
Loytec L-PAD through 8.4.16

Timeline

2026-07-24: advisory: NVD and vendor advisory published

References

https://www.loytec.com/support/product-security/advisories/8521-dibt-cve-20260526-0003-pam-passwordless-uid-0-authentication-high

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.