Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 54

Export CSV
CVE-2026-110935

Path traversal in plug-in deployment

The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Plcnext Engineer Plcnext Engineer
CVE-2026-110022

Signed plug-in validation bypass

The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Plcnext Engineer Plcnext Engineer
CVE-2026-110021

Missing GSDX SignatureValue verification

PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an invalid nonempty `SignatureValue`. PLCnext Engineer prior to 2026.6 reports the package as `Valid` and selects the modified device description for import under the default policy.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Plcnext Engineer Plcnext Engineer
CVE-2026-44093

Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact Phoenixcontact
Products
Charx Sec 3000 Charx Sec 3050 Charx Sec 3100 and 5 more
CVE-2026-27553

Information Disclosure via Schema Path Manipulation

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27563

Command Injection via GET in /api/datastorage/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 7.2 High EPSS 2.7% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27558

Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27548

Command Injection in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27564

Command Injection via PUT in /api/datastorage/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 7.2 High EPSS 2.7% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27561

Command Injection via GET in /api/iodd/config

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 7.2 High EPSS 2.7% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27560

Command Injection via DELETE in /api/status/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 7.2 High EPSS 2.7% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27559

Command Injection via GET in /api/status/data

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27556

Local File Inclusion in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27555

Local File Inclusion in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27554

Command Injection in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27551

Command Injection in /index.php/ajax/parameterManage

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27549

Command Injection in /index.php/attached_devices_tab/do_upload

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more