Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Loytec |
|
No data.
No data.
References
History
Mon, 27 Jul 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Loytec
Loytec l-dali Loytec l-gate Loytec l-inx Loytec l-iob Loytec l-pad Loytec l-roc Loytec l-vis Loytec lip-me20xc |
|
| Vendors & Products |
Loytec
Loytec l-dali Loytec l-gate Loytec l-inx Loytec l-iob Loytec l-pad Loytec l-roc Loytec l-vis Loytec lip-me20xc |
Fri, 24 Jul 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products. | |
| Title | Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod) | |
| Weaknesses | CWE-125 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: NCSC.ch
Published: 2026-07-24T14:00:48.771Z
Updated: 2026-07-24T14:53:49.184Z
Reserved: 2026-06-17T09:48:05.268Z
Link: CVE-2026-55732
Vulnrichment
No data.
NVD
No data.
Redhat
No data.