EUVD-2026-80244

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27560 Command Injection via DELETE in /api/status/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80243

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27560

CVE-2026-27560 is a command injection vulnerability in the /api/status/data endpoint, where a remote attacker with admin credentials can send a crafted DELETE request to execute arbitrary commands with root privileges on the device. The CVSS v3.1 score is 7.2 (HIGH) with a vector of AV:N/AC:L/PR:...

CVE-2026-27559

CVE-2026-27559 is a command injection vulnerability in the /api/status/data endpoint of a product managed by CERT VDE . A low-privileged remote attacker can send a crafted GET request with user credentials to execute commands with root privileges on the device. The assigned CVSS 3.1 score is 8.8 ...

CVE-2026-27558 Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/ajaxremoveuploadedioddfiles endpoint using operator credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80241

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/ajaxremoveuploadedioddfiles endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27558

CVE-2026-27558 is a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint of a PHP-based device web interface. A low-privileged remote attacker with operator credentials can inject commands that execute with root privileges on the device. ...

CVE-2026-27556 Local File Inclusion in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27556

A local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint of a VDE (Verband der Elektrotechnik) device allows a low-privileged remote attacker with a valid operator cookie to execute arbitrary PHP code on the device. The CNA is cert.vde.com , and related advisories...

EUVD-2026-80239

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27555

CVE-2026-27555 is a Local File Inclusion (LFI) vulnerability in the /index.php/ajax/get_iodd_port_info endpoint. A low-privileged remote attacker holding a valid user cookie can exploit it to achieve arbitrary PHP code execution on the device. The CVSS 3.1 base score is 8.8 (HIGH) , with network ...

EUVD-2026-80238

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27555 Local File Inclusion in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27554

CVE-2026-27554 is a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint, allowing a low-privileged remote attacker with operator credentials to execute commands with root privileges on the device. The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector and l...

EUVD-2026-80237

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/saveioddparameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80234

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27551

CVE-2026-27551 is a command injection vulnerability in the /index.php/ajax/parameterManage endpoint. A low-privileged remote attacker with valid user credentials can execute arbitrary commands with root privileges on the affected device. The CNA-assigned CVSS 3.1 score is 8.8 (HIGH) with a vector...

CVE-2026-27550

CVE-2026-27550 is a command injection vulnerability in the Field_Shadow_Password class, as reported by CERT-VDE (CNA: [email protected]). A low-privileged remote attacker can exploit this flaw using operator credentials to execute commands with root privileges on the affected device, resulting in...

CVE-2026-27550 Command Injection in Field_Shadow_Password Class

A low-privileged remote attacker can exploit a command injection vulnerability in the FieldShadowPassword class using operator credentials allowing execution of commands with root privileges on the device...