LOYTEC L-IP BACnet/IP Routers Cross-site Scripting (CVE-2026-12496)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505943);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/07");

  script_cve_id("CVE-2026-12496");

  script_name(english:"LOYTEC L-IP BACnet/IP Routers Cross-site Scripting (CVE-2026-12496)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An unauthenticated remote attacker can inject and store
malicious JavaScript in the OPC XML-DA server statistics page
(/webui/statistics/opc_srv) of a LOYTEC L-IP BACnet/IP router by
sending a crafted 'User-Agent' header in a POST request to the
device's '/da' endpoint. The script executes in an
administrator's browser when the statistics page is later
viewed, enabling session hijacking, credential theft, or device
reconfiguration.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.loytec.com/support/product-security/advisories/8522-dibt-cve-20260526-0004-unauthenticated-stored-xxs-in-opc-xml-da-server-statistics-high
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4e9e8106");
  script_set_attribute(attribute:"solution", value:
"Upgrade to firmware version 8.4.18 or later.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:X");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-12496");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:loytec:lip-me201c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:loytec:lip-me202c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:loytec:lip-me204c_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_cwe_id(79, 116);
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/LOYTECElectronics");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/LOYTECElectronics');

var asset = tenable_ot::assets::get(vendor:'LOYTECElectronics');

var vuln_cpes = {
    "cpe:/o:loytec:lip-me201c_firmware" :
        {"versionEndExcluding" : "8.4.18", "family" : "LIPBacnetRouters"},
    "cpe:/o:loytec:lip-me202c_firmware" :
        {"versionEndExcluding" : "8.4.18", "family" : "LIPBacnetRouters"},
    "cpe:/o:loytec:lip-me204c_firmware" :
        {"versionEndExcluding" : "8.4.18", "family" : "LIPBacnetRouters"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);