CVE-2026-27562

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27565

This remote code execution vulnerability allows an unauthenticated remote attacker to upload a malicious IODD file that places and executes a shell script with root privileges on the target system. The shell script persists across reboots , enabling sustained compromise. The CVSS 3.1 score is 9.8...

EUVD-2026-80248

An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...

CVE-2026-27562 Command Injection via PUT in /api/iodd/config

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27562

CVE-2026-27562 is a command injection vulnerability in the /api/iodd/config endpoint. A remote attacker with admin-level credentials can send a crafted PUT request to execute arbitrary commands with root privileges on the affected device. The CVSS 3.1 score is 7.2 (HIGH) (AV:N/AC:L/PR:H/UI:N/S:U/...

EUVD-2026-80245

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80244

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27561

CVE-2026-27561 is a command injection vulnerability in the /api/iodd/config endpoint. A high-privileged remote attacker can exploit it by sending a crafted GET request with admin credentials , enabling execution of commands with root privileges on the affected device. The CNA is CERT-VDE , which ...

CVE-2026-27552

CVE-2026-27552 is a high-severity vulnerability (CVSS 3.1: 8.1) involving improper authorization in the /index.php/attached_devices_tab/do_upload endpoint. A low-privileged remote attacker can exploit this flaw to upload IODD files to the device, potentially altering device behavior or causing sy...

EUVD-2026-80235

A low-privileged remote attacker can exploit improper authorization in the /index.php/attacheddevicestab/doupload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes...

CVE-2026-27547 Command Injection in /index.php/ajax/get_iodd_menu_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...