CVE-2026-55729 Details
Description
Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link.
A vulnerability allowing the exposure of sensitive information has been identified in Loytec LWEB-802 versions prior to 5.0.8, across all platforms. This issue arises from the application's use of localStorage in the browser, which can be exploited by an unauthenticated remote attacker to leak stored management credentials. The vulnerability requires the victim to click on a crafted link that the attacker controls.
Users are advised to update to Loytec LWEB-802 version 5.0.8.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 24, 2026CISA-ADP
Assessed Jul 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.loytec.com/support/product-security/advisories/8526-dibt-cve-20260601-0001-exposure-of-credentials-stored-in-browser-local-storage-high | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Loytec LWEB-802 | < 5.0.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | New CVE Received | [email protected] |
| Jul 24, 2026 | CVE Modified | CISA-ADP |