CVE-2026-55728 is a stack-based buffer overflow vulnerability in the cmd_ipaddr_conflict function of /usr/bin/ltsudo on Loytec LIP-ME20xC devices running LINX-A64 firmware up to version 8.4.16. A local attacker with superadmin group privileges can exploit this by providing an excessively long interface-name argument, which may cause the SUID-root process to abort or potentially lead to privilege escalation. The vulnerability is classified under CWE-121 and has a CVSS 4.0 score of 3.8, indicating low severity. There is no vendor advisory or patch available at this time, and no known exploits have been reported in the wild.

Exploitation of this vulnerability can cause the SUID-root process to abort, resulting in denial of service for that process. Additionally, there is potential for privilege escalation if the buffer overflow is successfully leveraged, allowing a local superadmin user to gain higher privileges. The impact is limited by the requirement for local superadmin group access and the low complexity of the attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict superadmin group membership to trusted users only and monitor for any unusual activity involving the /usr/bin/ltsudo process. Avoid supplying overly long interface-name arguments to the vulnerable command.