Pepperl+fuchs Ice3-8iol-G65l-V1d
14 CVEs affecting Pepperl+fuchs Ice3-8iol-G65l-V1d. Latest disclosed: 2026-09-16. Critical: 1, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27565 | Critical | 9.8 | 2026-09-16 | An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains acti… |
CVE-2026-27559 | High | 8.8 | 2026-09-16 | A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user cred… |
CVE-2026-27558 | High | 8.8 | 2026-09-16 | A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint… |
CVE-2026-27556 | High | 8.8 | 2026-09-16 | A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator c… |
CVE-2026-27555 | High | 8.8 | 2026-09-16 | A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie… |
CVE-2026-27554 | High | 8.8 | 2026-09-16 | A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials… |
CVE-2026-27550 | High | 8.8 | 2026-09-16 | A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution… |
CVE-2026-27557 | High | 7.5 | 2026-09-16 | An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's priv… |
CVE-2026-27564 | High | 7.2 | 2026-09-16 | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin crede… |
CVE-2026-27563 | High | 7.2 | 2026-09-16 | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with adm… |
CVE-2026-27562 | High | 7.2 | 2026-09-16 | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin cr… |
CVE-2026-27561 | High | 7.2 | 2026-09-16 | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin cr… |
CVE-2026-27560 | High | 7.2 | 2026-09-16 | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin… |
CVE-2026-27553 | Medium | 6.5 | 2026-09-16 | A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user co… |