CyberRota Analysis
AI-GeneratedImproper privilege management in the `ltsudo` utility of Loytec devices allows an attacker in the `superadmin` group to reset passwords for any LARM user, including critical service accounts like `larmapp`. This vulnerability could lead to unauthorized access and control over the affected systems, posing a significant risk to the integrity and confidentiality of the devices. Organizations using Loytec products, particularly those in critical infrastructure sectors, should prioritize addressing this vulnerability to mitigate potential exploitation.
Original NVD Description
Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.