This vulnerability (CWE-606) arises from unchecked input used as a loop condition in the SNMP agent of Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD products through version 8.4.16 on LINX-A64. An unauthenticated remote attacker can send a specially crafted SNMP GETNEXT request containing a large OID component, triggering excessive CPU consumption and causing a persistent denial of service condition. The CVSS 4.0 base score is 6.6, reflecting medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. There is no known exploit in the wild and no vendor-provided patch or mitigation details at this time.

Successful exploitation results in persistent denial of service by exhausting CPU resources on affected devices. This can disrupt normal operation of the affected Loytec products, potentially impacting systems relying on these devices for building automation or control. The vulnerability does not require authentication and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting SNMP access to trusted networks or devices to reduce exposure. Monitor for unusual SNMP traffic patterns indicative of exploitation attempts. No official fix or temporary workaround is currently documented.