🚨Critical - Loytec Controllers: larm_starter Symlink Attack Yields Root (CVE-2026-12503) Loytec's L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD devices (through 8.4.16 on LINX-A64) ship a /usr/bin/larm_starter helper that changes permissions on a fixed file path while blindly following symlinks (CWE-59). By replacing that path with a link to a sensitive system file, an authenticated larmapp-context attacker can make that file writable and abuse it to escalate to root. Because these are building-automation controllers, root access translates directly into control of HVAC, lighting, and other physical systems. The attacker needs a local/authenticated foothold, not network reach. CVSS 9.2. 👉Patch to the fixed release via Loytec's advisory and tighten access to the affected controllers.
Post summary
Loytec built‑automation controllers suffer a symlink‑based privilege escalation (CVE‑2026‑12503) that could grant root to an authenticated local attacker; a patch is available via Loytec’s advisory.