CVE-2026-55732 in LIP-ME20xC
Summary
by MITRE • 07/24/2026
Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This out-of-bounds read vulnerability exists in the BACnet packet parsing functionality of several Loytec industrial networking devices including the LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD models. The flaw specifically resides in the bacdt_datetime_to_tod function which processes datetime information within BACnet protocol packets. When processing TimeSynchronization or UTC-TimeSynchronization packets, the system fails to properly validate month values, allowing an attacker to submit malformed packets containing invalid month data that exceeds the bounds of allocated memory arrays.
The technical implementation of this vulnerability stems from insufficient input validation and boundary checking within the datetime parsing routine. The bacdt_datetime_to_tod function does not perform adequate range checks on the month field extracted from incoming BACnet packets, leading to memory access violations when attempting to read beyond allocated array boundaries. This classic CWE-125 vulnerability occurs because the system assumes valid input data without proper sanitization before processing. The attack vector is particularly dangerous as it requires no authentication and can be executed remotely over the network, making it a significant threat to industrial control systems.
The operational impact of this vulnerability extends beyond simple service disruption to potentially compromise entire industrial networks. When an attacker successfully exploits this flaw, the linx_a64.exe process crashes and subsequently reboots the affected device, creating denial-of-service conditions that can disrupt critical infrastructure operations. This is particularly concerning in industrial environments where network reliability and continuous operation are paramount for safety and productivity reasons. The vulnerability affects multiple Loytec products sharing the same underlying software architecture, indicating a systemic issue rather than an isolated defect.
Security professionals should immediately implement network segmentation to isolate affected devices from critical network segments and monitor for suspicious BACnet traffic patterns. Device firmware updates should be applied as soon as patches become available from Loytec, following the manufacturer's security advisory guidance. Network intrusion detection systems should be configured to identify and alert on malformed BACnet packets containing invalid month values, particularly those targeting the TimeSynchronization and UTC-TimeSynchronization services. Organizations implementing industrial control system security measures should consider this vulnerability in their risk assessments and ensure proper network monitoring capabilities are in place to detect potential exploitation attempts.
This vulnerability aligns with ATT&CK technique T1499.002 for network denial of service attacks, where adversaries leverage protocol parsing flaws to disrupt system availability. The weakness represents a critical security gap in industrial networking equipment that could potentially be leveraged as part of broader attack campaigns targeting operational technology environments. The fact that multiple similar products share this vulnerability indicates a systemic software design flaw requiring comprehensive remediation across affected product lines rather than individual device patches.