CVE-2023-46381 is a critical authentication bypass vulnerability affecting various LOYTEC LINX, LVIS, and LIOB devices across all versions. An unauthenticated attacker can exploit this flaw by accessing the preinstalled LWEB-802 via a specific URI, allowing them to modify existing projects or create new ones, thereby gaining control over the device's graphical user interface. This vulnerability carries a CVSS score of 8.2 (High), indicating a network-based attack with low complexity and high impact on integrity and low impact on availability. While there is no evidence of active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.2.4CPE matchmatch criteria | cpe:2.3:o:loytec:linx-212_firmware:6.2.4:*:*:*:*:*:*:* | ||
6.2.2CPE matchmatch criteria | cpe:2.3:o:loytec:lvis-3me12-a1_firmware:6.2.2:*:*:*:*:*:*:* | ||
6.2.3CPE matchmatch criteria | cpe:2.3:o:loytec:liob-586_firmware:6.2.3:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.