CVE-2026-55732

Loytec devices, including the LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD, are vulnerable to an out-of-bounds read issue in BACnet packet parsing, which can be exploited by unauthenticated remote attackers. By sending a malformed BACnet TimeSynchronization packet with an invalid month value, an attacker can crash the `linx_a64.exe` process, potentially leading to device reboot and service disruption. Organizations using these Loytec products should prioritize patching to mitigate the risk of remote exploitation and ensure operational continuity.