CVE-2026-55730: Loytec LWEB-802 XSS Vulnerability

CVE-2026-55730 Overview

CVE-2026-55730 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Loytec LWEB-802 building automation web interface prior to version 5.0.8. An unauthenticated remote attacker can craft a malicious link that injects arbitrary JavaScript through the project or mspParams URL parameters. When a victim clicks the link, the injected script executes in the victim's browser under the origin of the LWEB-802 application. The attacker then performs actions with the victim's privileges, including session theft, configuration changes, and pivoting deeper into the operational technology environment.

Critical Impact
Unauthenticated attackers can hijack authenticated LWEB-802 sessions and execute privileged actions against building automation systems via a single crafted link.

Affected Products

Loytec LWEB-802 versions prior to 5.0.8
LWEB802 web application component
All platforms running the vulnerable LWEB-802 build

Discovery Timeline

2026-07-24 - CVE-2026-55730 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-55730

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the LWEB-802 web interface. The application accepts attacker-controlled input through the project and mspParams query parameters and reflects that input back into rendered HTML without sufficient encoding or sanitization. Because the flaw requires no authentication, any attacker who can deliver a URL to a logged-in operator can trigger script execution in the browser context of the target application.

The attack chain is straightforward. An attacker crafts a URL pointing to a vulnerable LWEB-802 endpoint with a JavaScript payload embedded in project or mspParams. Social engineering, phishing, or a watering-hole page delivers the link. When a victim with an active LWEB-802 session opens the URL, the payload runs and inherits the victim's privileges within the application.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The LWEB-802 application fails to apply context-aware output encoding to the project and mspParams parameters before writing them into the response body. User-supplied values reach the DOM as executable script rather than inert text.

Attack Vector

Exploitation requires network access to the LWEB-802 interface and user interaction to open the crafted link. No credentials are needed by the attacker, but the impact scales with the privileges of the victim who clicks the URL. Refer to the Loytec Security Advisory for vendor technical details.

// Illustrative pattern - do not use for exploitation
https://<lweb802-host>/path?project=<injected-script-payload>
https://<lweb802-host>/path?mspParams=<injected-script-payload>

Detection Methods for CVE-2026-55730

Indicators of Compromise

Web server or reverse proxy logs containing requests to LWEB-802 endpoints with project or mspParams values that include HTML tags, javascript: URIs, or event handler attributes such as onerror and onload.
Outbound browser requests from operator workstations to unfamiliar domains immediately after LWEB-802 page loads, indicating possible data exfiltration by injected script.
Unexpected configuration changes or session activity within LWEB-802 that correlate in time with user clicks on external links.

Detection Strategies

Deploy signature-based Web Application Firewall (WAF) rules that flag script keywords, encoded angle brackets, and event handlers appearing in the project and mspParams parameters.
Correlate email gateway telemetry with proxy logs to identify inbound links pointing at LWEB-802 hosts with suspicious query strings.
Baseline the length and character set of legitimate values for both parameters, then alert on statistical outliers.

Monitoring Recommendations

Forward LWEB-802 and reverse proxy access logs into a centralized SIEM for retention and query.
Monitor endpoint browser telemetry on engineering workstations that operate building automation consoles for anomalous script execution and cross-origin requests.
Track user reports of unexpected pop-ups, redirects, or session logouts when accessing the LWEB-802 interface.

How to Mitigate CVE-2026-55730

Immediate Actions Required

Upgrade all LWEB-802 installations to version 5.0.8 or later as published in the Loytec security advisory.
Restrict network access to the LWEB-802 web interface to trusted management networks only, using firewall or VPN segmentation.
Instruct operators to avoid clicking LWEB-802 URLs received from untrusted sources until the patch is applied.

Patch Information

Loytec has released LWEB-802 version 5.0.8 that addresses the reflected XSS in the project and mspParams parameters. Review the Loytec Security Advisory for download instructions and verification steps.

Workarounds

Place a WAF or reverse proxy in front of LWEB-802 with rules that reject requests containing script metacharacters in the project and mspParams parameters.
Enforce a strict Content Security Policy (CSP) at the proxy layer to block inline script execution originating from reflected input.
Require operators to authenticate through a jump host and open the LWEB-802 interface only in a dedicated browser profile with no cross-site session cookies.

bash

# Example ModSecurity rule to block script payloads in vulnerable parameters
SecRule ARGS:project|ARGS:mspParams "@rx (?i)(<script|javascript:|onerror=|onload=)" \
  "id:1026055730,phase:2,deny,status:403,\
   msg:'CVE-2026-55730 LWEB-802 reflected XSS attempt blocked'"