Stored Cross-Site Scripting Vulnerability in Loytec XML-DA Server Products
CVE-2026-12496

8.7HIGH

Key Information:

Vendor

Loytec

Status
Lip-me20xc
L-inx
L-gate
L-roc
Vendor
CVE Published:
24 July 2026

What is CVE-2026-12496?

The Loytec OPC XML-DA server is vulnerable to a stored cross-site scripting attack that can be exploited by unauthenticated remote attackers. By sending a specially crafted User-Agent header within a POST /da request, attackers could execute arbitrary JavaScript in an administrator's browser session. This vulnerability can lead to session hijacking, unauthorized credential access, and potential device reconfiguration, highlighting the need for immediate security attention.

Affected Version(s)

L-DALI 0 <= 8.4.16

L-GATE 0 <= 8.4.16

L-INX 0 <= 8.4.16

References

https://www.loytec.com/support/product-security/advisorie...
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Hulliger, armasuisse CYD Campus
Damian Pfammatter, armasuisse CYD Campus
.