This vulnerability arises from improper handling of symbolic links in the larm_starter executable used by Loytec L-INX and related products. An authenticated attacker with larmapp group privileges can create a symlink from /etc/lighttpd/ssl/server.pem to /etc/passwd, causing the system to incorrectly modify /etc/passwd permissions. This results in /etc/passwd becoming writable by the larmapp group, enabling privilege escalation to root. The CVSS 4.0 score is 9.2, indicating a critical severity with high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An authenticated attacker with larmapp privileges can leverage this vulnerability to escalate privileges to root by making the /etc/passwd file writable by the larmapp group. This compromises system integrity and can lead to full system takeover. The vulnerability affects multiple Loytec products running L-INX through version 8.4.16 on LINX-A64.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated access to trusted users only and monitor for suspicious activity related to symlink creation or modification of /etc/passwd. Avoid granting unnecessary larmapp privileges to users.