This vulnerability involves improper privilege management (CWE-269) in the /usr/bin/ltsudo binary on Loytec LIP-ME20xC and associated products running LINX-A64 up to version 8.4.16. An attacker who is already a member of the superadmin group can exploit the set-passwd subcommand to reset passwords of any LARM user account, including the larmapp service account. This could allow unauthorized privilege escalation or disruption of service. The vulnerability is documented with CVSS 4.0 vector AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, indicating local attack with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

An attacker with superadmin group privileges can reset passwords for any LARM user account, including critical service accounts. This could lead to unauthorized access or control over system components that rely on these accounts, potentially compromising system integrity and availability. The vulnerability requires local access with high privileges but results in high impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict superadmin group membership to trusted users only and monitor for unauthorized use of the set-passwd subcommand. No official fix or temporary workaround has been published by the vendor at this time.