CVE-2026-12496 in LIP-ME20xC
Summary
by MITRE • 07/24/2026
Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability represents a critical stored cross-site scripting flaw that enables unauthenticated remote attackers to inject malicious javascript code into the OPC XML-DA server statistics of multiple Loytec industrial networking devices. The affected products include LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD models through version 8.4.16 running on LINX-A64 platforms. The vulnerability specifically manifests when the system processes a crafted User-Agent header within a POST request to the /da endpoint, allowing attackers to store malicious script code that executes in the context of administrator browser sessions.
The technical implementation involves the OPC XML-DA server failing to properly sanitize user input from the User-Agent header before storing and subsequently rendering this data in the web interface statistics. This creates a persistent XSS vulnerability where attacker-controlled javascript code becomes permanently embedded within the server's statistical reports, executing whenever administrators view these pages. The attack vector requires only a single malicious POST request with a specially crafted User-Agent header, making it particularly dangerous as it can be exploited without prior authentication credentials.
The operational impact of this vulnerability extends beyond simple script execution to enable sophisticated attack scenarios including session hijacking, credential theft, and unauthorized device reconfiguration. When administrators access the statistics pages, their browsers execute the stored javascript code, potentially allowing attackers to steal administrative sessions, capture login credentials, or modify device configurations through the compromised browser context. This creates a significant risk for industrial control systems where these devices typically operate with elevated privileges and handle critical infrastructure data.
Security professionals should implement multiple layers of mitigation including input validation and output encoding at the application level to prevent User-Agent header data from being stored without proper sanitization. Network segmentation and access controls should be enforced to limit exposure of administrative interfaces, while regular security updates and monitoring of web traffic for suspicious User-Agent patterns should be implemented. The vulnerability aligns with CWE-79 standards for cross-site scripting and maps to ATT&CK technique T1566 for social engineering through crafted content, emphasizing the need for robust input validation and context-aware output encoding in industrial web applications.
Organizations using these Loytec devices should immediately implement network access controls limiting administrative interface exposure, deploy web application firewalls to filter malicious User-Agent headers, and conduct comprehensive security assessments of all industrial control system web interfaces. Regular firmware updates from Loytec should be prioritized to address this vulnerability, while incident response procedures should include monitoring for suspicious javascript execution patterns in administrator sessions. The persistent nature of stored XSS vulnerabilities requires ongoing vigilance and regular security scanning to ensure that no malicious payloads have been successfully injected into the affected systems' statistics databases.