# CVE-2026-55730: Loytec LWEB-802 reflected cross-site scripting in LWEB802

Source: https://junglewise.ai/threats/cve-2026-55730-loytec-lweb-802-reflected-cross-site-scripting-in-lweb802  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-55730 · Severity: info · CVSS 8.7 · Published 2026-07-24

Loytec LWEB-802, a building management and automation software, is vulnerable to a security flaw that allows attackers to run malicious code in a user's web browser. By tricking a user into clicking a specially crafted link, an attacker can hijack the user's session, perform unauthorized actions with their privileges, or steal sensitive information. This could lead to unauthorized access to building control systems or data exposure.

Vendors: [LOYTEC](https://junglewise.ai/threats/vendors/loytec).

## Quick answers

**Is CVE-2026-55730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55730 being exploited in the wild.

**How severe is CVE-2026-55730?** Informational severity, with a CVSS score of 8.7, published 24 July 2026.

**Which products and versions are affected?** LOYTEC LWEB-802 before 5.0.8.

**Is there a fix for CVE-2026-55730?** A patch was published on 2026-07-24: Fix released in version 5.0.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55730 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55730?** Check whether you run LOYTEC LWEB-802 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the LWEB802 component of Loytec LWEB-802. The root cause is improper neutralization of input during web page generation (CWE-79) and improper encoding of output (CWE-116) within the 'project' and 'mspParams' parameters. An unauthenticated remote attacker can exploit this by sending a crafted URL to a victim. If the victim visits the link, the attacker's JavaScript executes within the context of the victim's browser session, potentially leading to session hijacking or unauthorized administrative actions. The vulnerability is addressed in version 5.0.8.

## Affected products

- Loytec LWEB-802 before 5.0.8

## Timeline

- 2026-07-24: advisory: NVD and vendor advisory published
- 2026-07-24: patched: Fix released in version 5.0.8

## References

- [https://www.loytec.com/support/product-security/advisories/8527-dibt-cve-20260601-0002-reflected-cross-site-scripting-xss-high](https://www.loytec.com/support/product-security/advisories/8527-dibt-cve-20260601-0002-reflected-cross-site-scripting-xss-high)

## Related threats

- [Loytec LWEB-802 credential disclosure in browser localStorage](https://junglewise.ai/threats/cve-2026-55729-loytec-lweb-802-credential-disclosure-in-browser-localstorage)