CVE-2026-12504 in LIP-ME20xC
Summary
by MITRE • 07/24/2026
Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability represents a critical authentication flaw classified as CWE-287 within the Pluggable Authentication Modules configuration of several Loytec industrial networking devices including the LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD models. The issue manifests when an attacker can exploit a misconfiguration in the PAM authentication process to gain unauthorized root access through a specifically crafted entry in the `/etc/passwd` file that contains an empty password field. This fundamental weakness undermines the core security principle of proper authentication mechanisms and allows for privilege escalation without requiring any valid credentials.
The technical exploitation occurs when a local attacker manipulates the system's user database by inserting or modifying entries in the `/etc/passwd` file where the password field is left empty, effectively creating an account that can authenticate as uid=0 without providing a password. This misconfiguration bypasses normal authentication procedures and grants immediate root shell access to the compromised system, as demonstrated by the vulnerability affecting firmware versions through 8.4.16 on the LINX-A64 platform. The flaw stems from inadequate validation of user account configurations within the PAM framework and highlights poor input sanitization practices in the system's authentication module.
The operational impact of this vulnerability is severe for industrial control systems that rely on these Loytec devices, as it enables attackers to gain complete administrative control over network infrastructure equipment. Local attackers with physical or network access can exploit this weakness to establish persistent backdoors, modify critical system configurations, or exfiltrate sensitive operational data. The vulnerability affects multiple device types within the Loytec ecosystem, potentially allowing for widespread compromise across industrial networks that utilize these components for communication and control functions. This represents a significant risk to operational technology environments where system integrity and access control are paramount.
Organizations should immediately implement mitigations including verifying and correcting PAM configuration files to ensure proper password field validation, implementing regular security audits of authentication modules, and applying firmware updates from Loytec when available. System administrators must conduct thorough reviews of `/etc/passwd` entries to identify any accounts with empty password fields and remove or properly secure them. Network segmentation and access control measures should be strengthened to limit local attack surface, while monitoring systems should be configured to detect unauthorized modifications to critical system files. This vulnerability aligns with ATT&CK technique T1078 for Valid Accounts and T1548.001 for Abuse of Authentication System, emphasizing the need for comprehensive access control measures and proper authentication framework hardening.