Carlo Gavazzi Automation vulnerabilities

22 vulnerabilities

Known vulnerabilities in Carlo Gavazzi Automation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.

Products

5
10CriticalCVE-2012-6428carlo gavazzi automation · eos-box +1 moreCarlo Gavazzi EOS Box Hard-Coded CredentialsThe Carlo Gavazzi EOS-Box stores hard-coded passwords in the PHP file of the device. By using the hard-coded passwords, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.EPSS1.53%7.8HighCVE-2012-6427carlo gavazzi automation · eos-box +1 moreCarlo Gavazzi EOS Box SQL InjectionThe Carlo Gavazzi EOS-Box does not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.EPSS1.33%8.8HighCVE-2026-27547carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in /index.php/ajax/get_iodd_menu_infoA low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device.EPSS2.92%9.8CriticalCVE-2026-27565carlo gavazzi automation · yl212cei8m1io +14 moreRemote code execution via uploading a malicious IODD fileAn unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot.EPSS0.97%8.8HighCVE-2026-27550carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in Field_Shadow_Password ClassA low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with root privileges on the device.EPSS2.92%7.2HighCVE-2026-27562carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection via PUT in /api/iodd/configA high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device.EPSS2.73%8.8HighCVE-2026-27551carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in /index.php/ajax/parameterManageA low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.EPSS2.92%7.2HighCVE-2026-27564carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection via PUT in /api/datastorage/dataA high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device.EPSS2.73%9.8CriticalCVE-2026-27546carlo gavazzi automation · yl212cei8m1io +14 moreAuthentication Bypass in _account_logAn unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.EPSS1.02%8.8HighCVE-2026-27555carlo gavazzi automation · yl212cei8m1io +14 moreLocal File Inclusion in /index.php/ajax/get_iodd_port_infoA low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.EPSS0.89%7.2HighCVE-2026-27560carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection via DELETE in /api/status/dataA high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device.EPSS2.73%7.5HighCVE-2026-27557carlo gavazzi automation · yl212cei8m1io +14 morePath Traversal in /index.php/view_uploaded_iodd_fileAn unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.EPSS0.71%8.8HighCVE-2026-27558carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_filesA low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the device.EPSS2.92%6.5MediumCVE-2026-27553carlo gavazzi automation · yl212cei8m1io +14 moreInformation Disclosure via Schema Path ManipulationA low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes.EPSS0.56%8.8HighCVE-2026-27554carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in /index.php/ajax/save_iodd_parametersA low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.EPSS2.92%7.2HighCVE-2026-27561carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection via GET in /api/iodd/configA high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.EPSS2.73%7.2HighCVE-2026-27563carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection via GET in /api/datastorage/dataA high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.EPSS2.73%8.8HighCVE-2026-27559carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection via GET in /api/status/dataA low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device.EPSS2.92%8.8HighCVE-2026-27549carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in /index.php/attached_devices_tab/do_uploadA low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.EPSS2.92%8.8HighCVE-2026-27548carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in /index.php/ajax/get_iodd_port_infoA low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.EPSS2.92%