This vulnerability (CWE-287) affects the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD devices through version 8.4.16 on LINX-A64. A local attacker can bypass authentication by leveraging an /etc/passwd entry with an empty password field, allowing them to authenticate as uid=0 without a password and obtain a root shell. The CVSS 4.0 base score is 8.4, reflecting high severity with local attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability. No official patch or remediation level is currently indicated, and no known exploits are reported in the wild.

A local attacker with access to the affected system can gain root privileges without authentication, leading to full system compromise. This includes unauthorized access to sensitive data, modification or deletion of system files, and disruption of system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for unauthorized local access attempts. Avoid relying on the affected PAM configuration for authentication.