CVE-2026-27554 - Command Injection in /index.php/ajax/save_iodd_parameters

Back Back to CVE browser

HIGH

Command Injection in /index.php/ajax/save_iodd_parameters

Published Sep 16, 2026

8.8

HIGH

CVSS 3.1

EPSS 2.92%

Description

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.

Affected products

Vendor Carlo Gavazzi Automation Product Yl212cei8m1io Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Carlo Gavazzi Automation Product Yl212cpn8m1io Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Carlo Gavazzi Automation Product Yn115cei8rpio Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Carlo Gavazzi Automation Product Yn115cpn8rpio Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice2-8iol-G65l-V1d Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice2-8iol-K45p-Rj45 Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice2-8iol-K45s-Rj45 Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice2-8iol1-G65l-V1d Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice3-8iol-G65l-V1d Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice3-8iol-G65l-V1d-Y Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice3-8iol-K45p-Rj45 Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice3-8iol-K45s-Rj45 Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Pepperl+Fuchs Product Ice3-8iol1-G65l-V1d Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Phoenix Contact Product Iol Ma8 Eip Di8 Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4
Vendor Phoenix Contact Product Iol Ma8 PN Di8 Default
unaffected
Affected
- ≥ 1.0.0, < 1.7.4

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Carlo Gavazzi Automation	Yl212cei8m1io	unaffected	Affected ≥ 1.0.0, < 1.7.4
Carlo Gavazzi Automation	Yl212cpn8m1io	unaffected	Affected ≥ 1.0.0, < 1.7.4
Carlo Gavazzi Automation	Yn115cei8rpio	unaffected	Affected ≥ 1.0.0, < 1.7.4
Carlo Gavazzi Automation	Yn115cpn8rpio	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice2-8iol-G65l-V1d	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice2-8iol-K45p-Rj45	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice2-8iol-K45s-Rj45	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice2-8iol1-G65l-V1d	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice3-8iol-G65l-V1d	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice3-8iol-G65l-V1d-Y	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice3-8iol-K45p-Rj45	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice3-8iol-K45s-Rj45	unaffected	Affected ≥ 1.0.0, < 1.7.4
Pepperl+Fuchs	Ice3-8iol1-G65l-V1d	unaffected	Affected ≥ 1.0.0, < 1.7.4
Phoenix Contact	Iol Ma8 Eip Di8	unaffected	Affected ≥ 1.0.0, < 1.7.4
Phoenix Contact	Iol Ma8 PN Di8	unaffected	Affected ≥ 1.0.0, < 1.7.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-80237		Advisory
https://www.certvde.com/en/advisories/VDE-2026-014/
https://www.certvde.com/en/advisories/VDE-2026-027/
https://www.certvde.com/en/advisories/VDE-2026-028/

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner CERTVDE

Published Sep 16, 2026

Updated Sep 16, 2026

Reserved Feb 20, 2026

Link CVE-2026-27554

CISA Vulnrichment

Updated Sep 16, 2026

NVD

Status Awaiting Analysis

Modified Sep 16, 2026

Link CVE-2026-27554

Red Hat

No data

ENISA EUVD

Assigner CERTVDE

Published Sep 16, 2026

Updated Sep 16, 2026

Link EUVD-2026-80237

GitHub

No data