CVE-2026-12496 is a stored cross-site scripting vulnerability (CWE-79) affecting Loytec LIP-ME20xC and related products including L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD through version 8.4.16 on LINX-A64. The vulnerability arises from improper neutralization of input during web page generation in the OPC XML-DA server statistics component. An unauthenticated attacker can send a specially crafted User-Agent header in a POST /da request, which is stored and later rendered in the administrator's web interface, enabling execution of arbitrary JavaScript code. This can lead to high-impact consequences such as session hijacking, credential theft, and unauthorized device reconfiguration. No official fix or patch has been disclosed as of the publication date.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary JavaScript in the context of an administrator's browser session. This can lead to session hijacking, theft of credentials, and unauthorized reconfiguration of the affected devices. The vulnerability affects multiple Loytec products up to version 8.4.16 on LINX-A64. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should limit access to the affected web interfaces to trusted networks and users only. Monitoring for unusual POST /da requests with suspicious User-Agent headers may help detect exploitation attempts. Avoid using vulnerable versions in exposed environments if possible.