Pepperl+Fuchs vulnerabilities, page 2
34 vulnerabilities
Known vulnerabilities in Pepperl+Fuchs products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 62 products.
CVE-2026-27546carlo gavazzi automationyl212cei8m1io+14
EPSS score1.02%
An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.CVE-2026-27555carlo gavazzi automationyl212cei8m1io+14EPSS score0.89%
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.CVE-2026-27560carlo gavazzi automationyl212cei8m1io+14EPSS score2.73%
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device.CVE-2026-27557carlo gavazzi automationyl212cei8m1io+14EPSS score0.71%
An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.CVE-2026-27558carlo gavazzi automationyl212cei8m1io+14EPSS score2.92%
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the device.CVE-2026-27553carlo gavazzi automationyl212cei8m1io+14EPSS score0.56%
A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes.CVE-2026-27554carlo gavazzi automationyl212cei8m1io+14EPSS score2.92%
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.CVE-2026-27561carlo gavazzi automationyl212cei8m1io+14EPSS score2.73%
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.CVE-2026-27563carlo gavazzi automationyl212cei8m1io+14EPSS score2.73%
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.CVE-2026-27559carlo gavazzi automationyl212cei8m1io+14EPSS score2.92%
A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device.CVE-2026-27549carlo gavazzi automationyl212cei8m1io+14EPSS score2.92%
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.CVE-2026-27548carlo gavazzi automationyl212cei8m1io+14EPSS score2.92%
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.CVE-2026-27552carlo gavazzi automationyl212cei8m1io+14EPSS score0.60%
A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.CVE-2026-27556carlo gavazzi automationyl212cei8m1io+14EPSS score0.89%
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.