CVE-2026-27556 Local File Inclusion in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27556

A local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint of a VDE (Verband der Elektrotechnik) device allows a low-privileged remote attacker with a valid operator cookie to execute arbitrary PHP code on the device. The CNA is cert.vde.com , and related advisories...

EUVD-2026-80239

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27554

CVE-2026-27554 is a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint, allowing a low-privileged remote attacker with operator credentials to execute commands with root privileges on the device. The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector and l...

CVE-2026-27554 Command Injection in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/saveioddparameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80237

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/saveioddparameters endpoint using operator credentials allowing execution of commands with root privileges on the device...