CVE-2026-27552 - Unauthorized IODD File Upload due to Improper Authorization

Back Back to CVE browser

HIGH

Unauthorized IODD File Upload due to Improper Authorization

Published Sep 16, 2026

8.1

HIGH

CVSS 3.1

EPSS 0.60%

Description

A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.

Affected products

Vendor Carlo Gavazzi Automation Product Yl212cei8m1io Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Carlo Gavazzi Automation Product Yl212cpn8m1io Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Carlo Gavazzi Automation Product Yn115cei8rpio Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Carlo Gavazzi Automation Product Yn115cpn8rpio Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice2-8iol-G65l-V1d Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice2-8iol-K45p-Rj45 Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice2-8iol-K45s-Rj45 Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice2-8iol1-G65l-V1d Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice3-8iol-G65l-V1d Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice3-8iol-G65l-V1d-Y Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice3-8iol-K45p-Rj45 Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice3-8iol-K45s-Rj45 Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice3-8iol1-G65l-V1d Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Phoenix Contact Product Iol Ma8 Eip Di8 Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Phoenix Contact Product Iol Ma8 PN Di8 Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Carlo Gavazzi Automation	Yl212cei8m1io	unaffected	Affected ≥ 1.0.0, < 1.7.4
Carlo Gavazzi Automation	Yl212cpn8m1io	unaffected	Affected ≥ 1.0.0, < 1.7.4
Carlo Gavazzi Automation	Yn115cei8rpio	unaffected	Affected ≥ 1.0.0, < 1.7.4
Carlo Gavazzi Automation	Yn115cpn8rpio	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice2-8iol-G65l-V1d	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice2-8iol-K45p-Rj45	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice2-8iol-K45s-Rj45	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice2-8iol1-G65l-V1d	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice3-8iol-G65l-V1d	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice3-8iol-G65l-V1d-Y	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice3-8iol-K45p-Rj45	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice3-8iol-K45s-Rj45	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice3-8iol1-G65l-V1d	unaffected	Affected ≥ 1.0.0, < 1.7.4
Phoenix Contact	Iol Ma8 Eip Di8	unaffected	Affected ≥ 1.0.0, < 1.7.4
Phoenix Contact	Iol Ma8 PN Di8	unaffected	Affected ≥ 1.0.0, < 1.7.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-80235		Advisory
https://www.certvde.com/en/advisories/VDE-2026-014/
https://www.certvde.com/en/advisories/VDE-2026-027/
https://www.certvde.com/en/advisories/VDE-2026-028/

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner CERTVDE

Published Sep 16, 2026

Updated Sep 16, 2026

Reserved Feb 20, 2026

Link CVE-2026-27552

CISA Vulnrichment

Updated Sep 16, 2026

NVD

Status Awaiting Analysis

Modified Sep 16, 2026

Link CVE-2026-27552

Red Hat

No data

ENISA EUVD

Assigner CERTVDE

Published Sep 16, 2026

Updated Sep 16, 2026

Link EUVD-2026-80235

GitHub

No data