CVE-2026-27554

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.

Score

CVSS 3.1 8.8 High

Status

Awaiting Analysis - info@cert.vde.com

Published

2026-09-16

Last modified

2026-09-16

Weaknesses

CWE-78

Affected products

• Yl212cei8m1io Firmware (Carlo Gavazzi)
• Yl212cpn8m1io Firmware (Carlo Gavazzi)
• Yn115cei8rpio Firmware (Carlo Gavazzi)
• Yn115cpn8rpio Firmware (Carlo Gavazzi)
• Ice2 Firmware (Pepperl Fuchs)
• Ice3 Firmware (Pepperl Fuchs)
• Iol Ma8 Eip Di8 Firmware (Phoenix Contact)
• Iol Ma8 Pn Di8 Firmware (Phoenix Contact)

References

• https://www.certvde.com/en/advisories/VDE-2026-014/
• https://www.certvde.com/en/advisories/VDE-2026-027/
• https://www.certvde.com/en/advisories/VDE-2026-028/