CVE-2026-55731: Loytec SNMP Agent DoS Vulnerability

CVE-2026-55731 Overview

CVE-2026-55731 is an unchecked input for loop condition vulnerability [CWE-606] in the Simple Network Management Protocol (SNMP) agent shipped with multiple Loytec building automation products. Affected devices include LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through firmware 8.4.16 on the LINX-A64 platform. An unauthenticated remote attacker can send a crafted SNMP GETNEXT request containing a large Object Identifier (OID) component. The agent enters a runaway loop and consumes CPU resources, producing a persistent denial of service on the device.

Critical Impact
A single unauthenticated network request can drive the SNMP agent CPU to exhaustion, disrupting management of Loytec building automation controllers.

Affected Products

Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD firmware through 8.4.16
LINX-A64 hardware platform running the vulnerable SNMP agent
Building automation deployments exposing UDP/161 on affected controllers

Discovery Timeline

2026-07-24 - CVE-2026-55731 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-55731

Vulnerability Analysis

The flaw resides in the SNMP agent's handling of OID traversal during a GETNEXT operation. SNMP GETNEXT walks the Management Information Base (MIB) tree by taking a client-supplied OID and returning the lexicographically next value. The affected agent uses an attacker-controlled OID component to drive a loop condition without bounding the iteration count. When the component is unusually large, the loop iterates far beyond expected ranges. The result is CPU exhaustion that persists until the device is restarted or the process is externally terminated.

Availability is the sole impacted property. Confidentiality and integrity are not affected, and no authentication is required to reach the vulnerable code path.

Root Cause

The root cause is missing validation on a numeric field derived from the incoming OID before that field is used to control a loop. This maps directly to CWE-606: Unchecked Input for Loop Condition. The agent trusts the client-supplied value as an iteration bound rather than sanity-checking it against the MIB structure or a hard upper limit.

Attack Vector

An attacker sends a single crafted SNMP GETNEXT protocol data unit (PDU) to UDP port 161 on the target device. The PDU includes a variable binding whose OID contains a component with an inflated numeric value. No credentials, community string knowledge beyond default read access, or user interaction is required if the agent is reachable and accepts the request. The Loytec advisory documents the affected products and firmware line. See the Loytec Security Advisory for vendor details.

Detection Methods for CVE-2026-55731

Indicators of Compromise

Sustained high CPU utilization on the SNMP agent process of Loytec LINX-A64 controllers
Inbound SNMP GETNEXT PDUs on UDP/161 containing OID components with abnormally large numeric sub-identifiers
Loss of SNMP responsiveness or management-plane availability on affected devices following a specific inbound packet

Detection Strategies

Deploy network intrusion detection signatures that flag SNMP GETNEXT requests where any OID sub-identifier exceeds a reasonable threshold for the vendor MIB
Correlate device availability alerts with preceding SNMP traffic to identify triggering packets
Baseline SNMP query patterns from authorized management stations and alert on deviations, especially from unexpected source addresses

Monitoring Recommendations

Log all inbound SNMP traffic to Loytec controllers at the perimeter or management VLAN boundary
Track SNMP agent process CPU and responsiveness metrics with alerting thresholds
Review firewall logs for UDP/161 traffic originating outside the authorized management network

How to Mitigate CVE-2026-55731

Immediate Actions Required

Restrict SNMP access on affected Loytec devices to a small allow-list of authorized management stations using firewall or ACL rules
Disable the SNMP agent on devices where SNMP monitoring is not operationally required
Isolate building automation controllers on a dedicated management VLAN not reachable from user or internet-facing networks

Patch Information

Firmware through 8.4.16 on LINX-A64 is affected. Consult the Loytec Security Advisory for the fixed firmware version and upgrade procedure for each product line (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD). Apply the vendor-supplied firmware update on all affected controllers.

Workarounds

Block inbound UDP/161 at the network boundary except from designated SNMP pollers
Change default community strings and disable SNMP versions or views not required for operations
Where feasible, migrate to SNMPv3 with authentication and restrict GETNEXT access to trusted principals

bash

# Example: restrict SNMP to a management subnet on an upstream firewall (iptables)
iptables -A FORWARD -p udp --dport 161 -s 10.20.30.0/24 -d <loytec_device_ip> -j ACCEPT
iptables -A FORWARD -p udp --dport 161 -d <loytec_device_ip> -j DROP