Pepperl+Fuchs ICE3 8IOL G65L V1D Y vulnerabilities
20 vulnerabilities
Known vulnerabilities in Pepperl+Fuchs ICE3 8IOL G65L V1D Y, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2026-27547carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in /index.php/ajax/get_iodd_menu_infoA low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device.EPSS2.92%CriticalCVE-2026-27565carlo gavazzi automation · yl212cei8m1io +14 moreRemote code execution via uploading a malicious IODD fileAn unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot.EPSS0.97%HighCVE-2026-27550carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in Field_Shadow_Password ClassA low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with root privileges on the device.EPSS2.92%HighCVE-2026-27562carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection via PUT in /api/iodd/configA high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device.EPSS2.73%HighCVE-2026-27551carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in /index.php/ajax/parameterManageA low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.EPSS2.92%HighCVE-2026-27564carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection via PUT in /api/datastorage/dataA high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device.EPSS2.73%CriticalCVE-2026-27546carlo gavazzi automation · yl212cei8m1io +14 moreAuthentication Bypass in _account_logAn unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.EPSS1.02%HighCVE-2026-27555carlo gavazzi automation · yl212cei8m1io +14 moreLocal File Inclusion in /index.php/ajax/get_iodd_port_infoA low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.EPSS0.89%HighCVE-2026-27560carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection via DELETE in /api/status/dataA high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device.EPSS2.73%HighCVE-2026-27557carlo gavazzi automation · yl212cei8m1io +14 morePath Traversal in /index.php/view_uploaded_iodd_fileAn unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.EPSS0.71%HighCVE-2026-27558carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_filesA low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the device.EPSS2.92%MediumCVE-2026-27553carlo gavazzi automation · yl212cei8m1io +14 moreInformation Disclosure via Schema Path ManipulationA low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes.EPSS0.56%HighCVE-2026-27554carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in /index.php/ajax/save_iodd_parametersA low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.EPSS2.92%HighCVE-2026-27561carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection via GET in /api/iodd/configA high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.EPSS2.73%HighCVE-2026-27563carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection via GET in /api/datastorage/dataA high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.EPSS2.73%HighCVE-2026-27559carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection via GET in /api/status/dataA low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device.EPSS2.92%HighCVE-2026-27549carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in /index.php/attached_devices_tab/do_uploadA low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.EPSS2.92%HighCVE-2026-27548carlo gavazzi automation · yl212cei8m1io +14 moreCommand Injection in /index.php/ajax/get_iodd_port_infoA low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.EPSS2.92%HighCVE-2026-27552carlo gavazzi automation · yl212cei8m1io +14 moreUnauthorized IODD File Upload due to Improper AuthorizationA low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.EPSS0.60%HighCVE-2026-27556carlo gavazzi automation · yl212cei8m1io +14 moreLocal File Inclusion in /index.php/ajax/save_iodd_parametersA low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.EPSS0.89%