CVE-2026-27553

Information Disclosure via Schema Path Manipulation

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27563

Command Injection via GET in /api/datastorage/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 7.2 High EPSS 2.7% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27558

Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27548

Command Injection in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27565

Remote code execution via uploading a malicious IODD file

An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27564

Command Injection via PUT in /api/datastorage/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 7.2 High EPSS 2.7% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27561

Command Injection via GET in /api/iodd/config

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 7.2 High EPSS 2.7% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27560

Command Injection via DELETE in /api/status/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 7.2 High EPSS 2.7% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27559

Command Injection via GET in /api/status/data

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27556

Local File Inclusion in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27555

Local File Inclusion in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27554

Command Injection in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27551

Command Injection in /index.php/ajax/parameterManage

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27550

Command Injection in Field_Shadow_Password Class

A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27549

Command Injection in /index.php/attached_devices_tab/do_upload

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27546

Authentication Bypass in _account_log

An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27557

Path Traversal in /index.php/view_uploaded_iodd_file

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27562

Command Injection via PUT in /api/iodd/config

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 7.2 High EPSS 2.7% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27552

Unauthorized IODD File Upload due to Improper Authorization

A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more

CVE-2026-27547

Command Injection in /index.php/ajax/get_iodd_menu_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Carlo Gavazzi Pepperl Fuchs Phoenix Contact

Products

Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more