Stored XSS in Loytec LINX-A64 OPC XML-DA Server

Executive Summary

This is an unauthenticated stored cross-site scripting (XSS) vulnerability in the OPC XML-DA server statistics feature of certain LOYTEC products. The flaw occurs because the server logs SOAP requests and displays client metadata, including the User-Agent header, without proper sanitization. An attacker can inject malicious JavaScript via a crafted User-Agent header in a POST request to /da. The payload is stored on the server and executed when an administrator views the statistics page.

Useful 0 Not Useful 0

Detection Guidance

Check LOYTEC device logs for suspicious User-Agent headers in POST /da requests. Inspect the OPC XML-DA server statistics page for stored JavaScript payloads. Monitor network traffic for unauthenticated SOAP requests to /da endpoints.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in an administrator's browser, leading to session hijacking, credential theft, or unauthorized device reconfiguration. Since the attack requires no authentication and the payload persists until logs are cleared, it poses a significant risk to system integrity and confidentiality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, non-compliance with privacy regulations, and potential legal consequences due to compromised credentials or session hijacking.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade affected LOYTEC devices to firmware version 8.4.18 or later. Disable or restrict access to the OPC XML-DA server statistics page until patched. Implement network-level controls to block unauthenticated POST /da requests.

Useful 0 Not Useful 0