CVE-2026-27559

HighCVSS 8.8/10Last modified Sep 16, 2026

Description

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Pepperl+Fuchs	ICE2-8IOL1-G65L-V1D	>= 1.0.0, < 1.7.4
Pepperl+Fuchs	ICE2-8IOL-G65L-V1D	>= 1.0.0, < 1.7.4
Pepperl+Fuchs	ICE2-8IOL-K45P-RJ45	>= 1.0.0, < 1.7.4
Pepperl+Fuchs	ICE2-8IOL-K45S-RJ45	>= 1.0.0, < 1.7.4
Pepperl+Fuchs	ICE3-8IOL1-G65L-V1D	>= 1.0.0, < 1.7.4
Pepperl+Fuchs	ICE3-8IOL-G65L-V1D	>= 1.0.0, < 1.7.4
Pepperl+Fuchs	ICE3-8IOL-G65L-V1D-Y	>= 1.0.0, < 1.7.4
Pepperl+Fuchs	ICE3-8IOL-K45P-RJ45	>= 1.0.0, < 1.7.4
Pepperl+Fuchs	ICE3-8IOL-K45S-RJ45	>= 1.0.0, < 1.7.4
Phoenix Contact	IOL MA8 PN DI8	>= 1.0.0, < 1.7.4
Phoenix Contact	IOL MA8 EIP DI8	>= 1.0.0, < 1.7.4
Carlo Gavazzi Automation	YL212CEI8M1IO	>= 1.0.0, < 1.7.4
Carlo Gavazzi Automation	YN115CEI8RPIO	>= 1.0.0, < 1.7.4
Carlo Gavazzi Automation	YL212CPN8M1IO	>= 1.0.0, < 1.7.4
Carlo Gavazzi Automation	YN115CPN8RPIO	>= 1.0.0, < 1.7.4

References

Timeline

Published: Sep 16, 2026
Last modified: Sep 16, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-27565.0A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. This affects an unknown function of the component BLE Inter CVE-2026-275607.2A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE CVE-2026-275617.2A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET re CVE-2026-275627.2A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT re CVE-2026-275637.2A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted G CVE-2026-275647.2A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT reque CVE-2026-275659.8An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell CVE-2026-275668.8OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shel CVE-2026-275674.8Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability ex CVE-2026-275686.1WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses Parsedown (v1.7.4) wi CVE-2026-27579.8Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox CVE-2026-275706.1Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the onebox method in the Share