CVE-2026-12504: Loytec Devices Auth Bypass Vulnerability

CVE-2026-12504 Overview

CVE-2026-12504 is an improper authentication vulnerability [CWE-287] affecting the Pluggable Authentication Modules (PAM) configuration on multiple Loytec building automation devices. The affected models include LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD running firmware through version 8.4.16 on the LINX-A64 platform. A local attacker can authenticate as a uid=0 account without supplying a password because an /etc/passwd entry contains an empty password field. Successful exploitation grants an interactive root shell on the device.

Critical Impact
A local attacker can obtain a root shell on affected Loytec LINX-A64 devices without any password, resulting in full compromise of the building automation controller.

Affected Products

Loytec LIP-ME201C, L-INX, L-GATE, L-ROC through firmware 8.4.16 on LINX-A64
Loytec L-IOB, L-DALI through firmware 8.4.16 on LINX-A64
Loytec L-VIS and L-PAD through firmware 8.4.16 on LINX-A64

Discovery Timeline

2026-07-24 - CVE-2026-12504 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-12504

Vulnerability Analysis

The vulnerability stems from a misconfigured PAM authentication stack combined with a weak /etc/passwd entry. On affected LINX-A64 firmware, an account with uid=0 exists with an empty password field. PAM accepts the empty password during authentication rather than rejecting the login attempt.

An attacker who can reach a local authentication interface, such as a serial console, an SSH service configured to trust password authentication, or an on-device shell, can log in as this root-equivalent account by supplying no password. The resulting shell runs with full root privileges on the embedded Linux operating system.

Loytec building automation devices manage lighting, HVAC, DALI networks, and other operational technology assets. Root access on these controllers permits firmware modification, credential theft, lateral pivoting into building networks, and manipulation of physical processes controlled by the device.

Root Cause

The root cause is a shipped /etc/passwd entry with an empty password field for a uid=0 account, combined with a PAM configuration that treats empty passwords as valid credentials rather than rejecting them. Secure PAM deployments typically use the nullok directive only for explicitly whitelisted, non-privileged accounts and enforce non-empty credentials for administrative users.

Attack Vector

Exploitation requires local access to an authentication surface exposed by the device. An attacker supplies the vulnerable uid=0 username at the login prompt and submits an empty password. PAM validates the empty string against the empty password field in /etc/passwd and grants a root shell. No prior credentials, exploitation primitives, or user interaction are required beyond reaching the authentication interface.

Refer to the Loytec Security Advisory for vendor-published technical details.

Detection Methods for CVE-2026-12504

Indicators of Compromise

Entries in /etc/passwd on affected devices containing a uid=0 account with an empty second field (for example, user::0:0:...).
Successful root logins in /var/log/auth.log or the device's syslog output that lack corresponding password prompt entries.
Unexpected shell sessions or configuration changes on Loytec controllers that cannot be attributed to authorized administrators.

Detection Strategies

Audit /etc/passwd on all Loytec LINX-A64 devices for accounts with uid=0 and verify that the password field contains an x referencing /etc/shadow with a valid hash.
Review PAM configuration files under /etc/pam.d/ for auth lines that permit nullok on privileged accounts.
Correlate console, SSH, and Telnet authentication events with expected administrative activity windows to identify anomalous root logins.

Monitoring Recommendations

Forward authentication logs from Loytec devices to a centralized log aggregation platform for retention and analysis.
Alert on any interactive root login originating from operational technology network segments where such access is not routinely expected.
Monitor building automation network segments for unauthorized SSH, Telnet, or serial console traffic targeting Loytec controllers.

How to Mitigate CVE-2026-12504

Immediate Actions Required

Restrict network access to management interfaces of affected Loytec devices to trusted administrative hosts only, using firewall rules or network segmentation.
Inspect /etc/passwd on each affected device and remove or replace any uid=0 account with an empty password field.
Disable unused authentication services such as Telnet and legacy remote consoles on affected controllers.
Rotate administrative credentials on all Loytec devices after remediation to invalidate any credentials that may have been observed by an attacker.

Patch Information

Consult the Loytec Security Advisory for vendor guidance on fixed firmware versions and upgrade procedures for LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD devices running firmware through 8.4.16 on the LINX-A64 platform.

Workarounds

Place affected controllers behind a dedicated management VLAN accessible only through a hardened jump host with strong authentication.
If shell access is available, edit /etc/passwd to set the password field of any uid=0 account to x and configure a strong password hash in /etc/shadow.
Review /etc/pam.d/ configuration files and remove nullok from any auth line that applies to privileged accounts.

bash

# Configuration example: audit for empty-password uid=0 accounts
awk -F: '($2 == "" && $3 == 0) { print "Empty password root account: " $1 }' /etc/passwd

# Remove nullok from PAM auth configuration
grep -rn 'nullok' /etc/pam.d/