CVE-2026-55728 is a stack-based buffer overflow vulnerability in the cmd_ipaddr_conflict function of /usr/bin/ltsudo on Loytec LIP-ME20xC devices (including LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD) running LINX-A64 firmware up to version 8.4.16. A superadmin group user can trigger this overflow by providing an excessively long interface-name argument, which may cause the SUID-root process to abort or potentially allow privilege escalation. The vulnerability requires local high-privilege access and does not involve user interaction. No official remediation or patch information is currently available.

The vulnerability allows a local attacker with superadmin group privileges to cause a SUID-root process to abort or potentially escalate privileges by exploiting a stack-based buffer overflow. The impact is limited by the requirement for high privileges and local access. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict superadmin group membership to trusted users only and monitor for attempts to exploit the /usr/bin/ltsudo cmd_ipaddr_conflict functionality with overly long interface-name arguments.