CVE-2026-55732 Overview
CVE-2026-55732 is an Out-of-bounds Read vulnerability [CWE-125] in the BACnet packet parsing routine bacdt_datetime_to_tod used across multiple Loytec building automation products. The flaw affects Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD devices through version 8.4.18 on the LINX-A64 platform. An unauthenticated remote attacker can send a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet containing an invalid month value. The malformed packet crashes the linx_a64.exe process and forces the device to reboot.
Critical Impact
Unauthenticated remote attackers can crash and reboot Loytec building automation controllers over the network, disrupting availability of BACnet-connected building systems.
Affected Products
- Loytec LIP-ME201C, L-INX, L-GATE, and L-ROC through 8.4.18 on LINX-A64
- Loytec L-IOB and L-DALI through 8.4.18 on LINX-A64
- Loytec L-VIS and L-PAD through 8.4.18 on LINX-A64
Discovery Timeline
- 2026-07-24 - CVE-2026-55732 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-55732
Vulnerability Analysis
The vulnerability resides in bacdt_datetime_to_tod, a helper function used during BACnet packet parsing. The function processes date and time fields carried within BACnet TimeSynchronization and UTC-TimeSynchronization service messages. When the month field contains a value outside the expected valid range, the function reads memory beyond an intended bounds. The out-of-bounds read corrupts execution state inside linx_a64.exe, terminating the process. The affected device reboots as a result, interrupting BACnet services and any building automation logic running on the controller.
Root Cause
The root cause is missing input validation on the month field of incoming BACnet datetime structures. bacdt_datetime_to_tod indexes into an internal lookup or table using the attacker-supplied month value without verifying the value falls within a valid range (1–12 or the BACnet unspecified sentinel). An invalid index triggers a read beyond the allocated buffer, classified as CWE-125.
Attack Vector
Attackers exploit the flaw remotely over the network with no authentication and no user interaction. A single crafted BACnet TimeSynchronization or UTC-TimeSynchronization packet directed at UDP port 47808 (BAC0) is sufficient to crash linx_a64.exe. Because BACnet devices frequently sit on flat operational technology (OT) networks, one attacker packet can reach many exposed controllers. Repeated packets keep affected devices in a reboot loop, producing a sustained denial-of-service condition against building automation infrastructure.
No verified public exploit code is available. See the LOYTEC Security Advisory #8532 for vendor technical details.
Detection Methods for CVE-2026-55732
Indicators of Compromise
- Unexpected reboots or process termination events on Loytec LINX-A64 controllers, particularly involving linx_a64.exe.
- BACnet UDP traffic (port 47808) containing TimeSynchronization or UTC-TimeSynchronization service requests with month field values outside 1–12.
- Loss of BACnet device availability correlated with inbound traffic from unexpected sources.
Detection Strategies
- Deploy network intrusion detection signatures that parse BACnet APDUs and flag TimeSynchronization or UTC-TimeSynchronization messages with malformed datetime fields.
- Monitor device syslog and SNMP traps from Loytec controllers for crash and restart events during time-synchronization traffic.
- Baseline legitimate BACnet time-sync sources and alert on packets originating outside the approved list.
Monitoring Recommendations
- Continuously log BACnet traffic at OT-IT boundaries and forward events into a centralized data lake for correlation.
- Track controller uptime and reboot counters as a primary availability signal for Loytec devices.
- Alert on repeated crashes of linx_a64.exe across multiple devices, which indicates coordinated exploitation.
How to Mitigate CVE-2026-55732
Immediate Actions Required
- Inventory all Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD devices and identify firmware versions at or below 8.4.18.
- Apply the Loytec-provided firmware update referenced in LOYTEC Security Advisory #8532 to every affected device.
- Restrict BACnet UDP port 47808 traffic to trusted management VLANs and known time-sync sources only.
Patch Information
Loytec has published Security Advisory #8532 covering the invalid TimeSync message crash. Refer to the vendor advisory for the fixed firmware release and installation guidance for each affected product family. Devices running versions after 8.4.18 with the vendor fix applied are no longer vulnerable.
Workarounds
- Segment BACnet controllers behind an OT firewall and permit inbound port 47808 traffic only from authorized BACnet Broadcast Management Devices (BBMDs) and time servers.
- Disable UTC-TimeSynchronization handling on devices where the feature is not required, if the product configuration allows it.
- Deploy a BACnet-aware protocol gateway or IDS to drop TimeSynchronization packets with out-of-range datetime fields until firmware updates are staged.
# Example firewall rule to restrict BACnet traffic to a trusted time-sync source
iptables -A FORWARD -p udp --dport 47808 -s 10.10.20.5 -d 10.20.0.0/16 -j ACCEPT
iptables -A FORWARD -p udp --dport 47808 -d 10.20.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
