CVE-2026-12496 Overview
CVE-2026-12496 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the OPC XML-DA server statistics component in multiple Loytec building automation devices. The impacted product lines include LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD firmware versions through 8.4.16 on the LINX-A64 platform. An unauthenticated remote attacker can inject arbitrary JavaScript by supplying a crafted User-Agent header in a POST /da request. The payload is later rendered in the administrator's browser when the statistics page is viewed, enabling session hijacking, credential theft, and device reconfiguration.
Critical Impact
Unauthenticated attackers can hijack administrator sessions and reconfigure operational technology (OT) devices controlling building automation systems.
Affected Products
- Loytec LIP-ME201C, L-INX, L-GATE, and L-ROC devices through firmware 8.4.16
- Loytec L-IOB, L-DALI, L-VIS, and L-PAD devices through firmware 8.4.16
- LINX-A64 platform builds shipping the vulnerable OPC XML-DA statistics endpoint
Discovery Timeline
- 2026-07-24 - CVE-2026-12496 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-12496
Vulnerability Analysis
The vulnerability resides in the OPC XML-DA endpoint exposed at POST /da on affected Loytec devices. The server records client metadata, including the raw User-Agent HTTP header, and later reflects that value into the administrative statistics interface without proper output encoding. Because the header is stored server-side and rendered when an administrator views the statistics page, the flaw qualifies as stored XSS rather than reflected XSS.
Exploitation requires no authentication. An attacker sends a single POST /da request containing JavaScript inside the User-Agent header. When any privileged operator later loads the statistics view, the browser executes the injected script under the administrator's session context. This gives the attacker the ability to steal session cookies, submit authenticated requests to modify device configuration, or pivot deeper into the OT network.
Root Cause
The root cause is missing output sanitization and encoding of HTTP request metadata before it is embedded into HTML rendered by the administrative UI. The server treats the User-Agent value as trusted display text rather than untrusted input from an anonymous network client.
Attack Vector
The attack vector is network-based and requires no privileges. The attacker only needs reachability to the device's OPC XML-DA HTTP endpoint. User interaction from a victim administrator is required to trigger execution, since the payload fires when the statistics page is viewed. Refer to the Loytec Security Advisory for vendor-provided technical details.
Detection Methods for CVE-2026-12496
Indicators of Compromise
- HTTP POST requests to the /da endpoint containing HTML or JavaScript syntax (for example <script, onerror=, javascript:) inside the User-Agent header
- Unexpected administrator sessions originating from atypical source addresses shortly after statistics page views
- Unplanned configuration changes on Loytec devices without a corresponding audit trail from a known operator
Detection Strategies
- Inspect web server and reverse proxy logs for anomalous User-Agent values on requests targeting /da
- Deploy web application firewall rules that flag scriptable content in HTTP headers reaching OT management interfaces
- Correlate administrator browser telemetry with device-side log entries to spot post-view configuration activity
Monitoring Recommendations
- Forward Loytec device HTTP access logs to a central SIEM for retention and pattern analysis
- Alert on any POST /da traffic sourced from outside the engineering VLAN or approved management subnet
- Monitor for outbound traffic from administrator workstations to unknown domains immediately after accessing device statistics pages
How to Mitigate CVE-2026-12496
Immediate Actions Required
- Restrict network access to the OPC XML-DA /da endpoint so it is reachable only from trusted engineering workstations
- Instruct administrators to avoid loading the device statistics page until firmware is updated
- Review recent device configurations for unauthorized changes and rotate any credentials that may have been exposed to an administrator browser session
Patch Information
Loytec has published guidance in the Loytec Security Advisory. Apply firmware updates released after version 8.4.16 for all affected LINX-A64 based product lines. Verify the running firmware version on every device in the fleet, since Loytec deployments frequently span multiple hardware families with independent update cycles.
Workarounds
- Place affected devices behind a reverse proxy that strips or normalizes the User-Agent header before it reaches the device
- Segment building automation networks so that only jump hosts on an isolated management VLAN can reach the OPC XML-DA endpoint
- Disable or firewall the OPC XML-DA service where it is not required for production integrations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
