CVE-2026-55729
Received Received - Intake

Loytec LWEB-802 localStorage Credential Exposure Vulnerability

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Switzerland Government Common Vulnerability Program

Description
Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-55729
EUVD
EUVD-2026-48594

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
loytec lweb-802 5.0.8
loytec l-roc_room_automation *
loytec l-inx_automation_servers *
loytec l-iob_i/o_controllers_and_modules *
loytec lpad-7_touch_panels *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55729 is a vulnerability in Loytec LWEB-802 software where sensitive credentials stored in a user's browser localStorage can be exposed. An unauthenticated attacker can trick a victim into clicking a malicious link, causing the stored credentials to be sent to the attacker. This allows unauthorized access to the management web application.

Detection Guidance

This vulnerability cannot be directly detected via network scanning or system commands as it requires user interaction with a crafted link. Check if any users have saved credentials in the LWEB-802 browser localStorage and verify the software version is below 5.0.8.

Impact Analysis

If you use Loytec LWEB-802 and have saved credentials in your browser, clicking a malicious link could expose your username and password. Attackers could then gain unauthorized access to the management web application, potentially compromising building automation systems or sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) if such data is exposed. Compliance may be impacted due to unauthorized access to personal or health-related information.

Mitigation Strategies

Immediately update LWEB-802 to version 5.0.8 or later. Instruct users to clear saved credentials in their browsers and avoid clicking on untrusted links. Monitor for unauthorized access attempts to the management web application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55729. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart