Reflected Cross-Site Scripting Vulnerability in Loytec LWEB-802
CVE-2026-55730

8.7HIGH

Key Information:

Vendor

Loytec

Status
Lweb-802
Vendor
CVE Published:
24 July 2026

What is CVE-2026-55730?

An unpatched reflected cross-site scripting vulnerability exists in Loytec LWEB-802 prior to version 5.0.8, allowing unauthenticated remote attackers to inject and execute arbitrary JavaScript in the context of a user's browser session. By crafting malicious links with specific parameters, attackers can exploit this weakness to perform actions on behalf of the victim, leading to potential data breaches and unauthorized access.

Affected Version(s)

LWEB-802 0 < 5.0.8

References

https://www.loytec.com/support/product-security/advisorie...
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Hulliger, armasuisse CYD Campus
Damian Pfammatter, armasuisse CYD Campus
.