{ "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "names": [ "Gabriele Quagliarella", "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting", "urls": [ "https://nozominetworks.com/" ] } ], "aggregate_severity": { "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "The affected devices have security vulnerabilities that can be used to bypass authentication. Code can be executed on the devices through command injection and local file inclusion. Path traversal and modified schemata can be used to read sensitive information such as password hashes or private keys from the devices.", "title": "Summary" }, { "category": "description", "text": "Authentication can be bypassed. Code with high access rights can be executed on the device so that the integrity of the device can be falsified. Sensitive information can be read out.", "title": "Impact" }, { "category": "description", "text": "- Minimize network exposure for affected products and ensure that they are not accessible via the Internet.\n- Isolate affected products from the corporate network.\n- If remote access is required, use secure methods such as virtual private networks(VPNs).", "title": "Mitigation" }, { "category": "description", "text": "Install the firmware update 1.7.8.", "title": "Remediation" } ], "publisher": { "category": "vendor", "contact_details": "cert@pepperl-fuchs.com", "name": "Pepperl+Fuchs SE", "namespace": "https://www.pepperl-fuchs.com" }, "references": [ { "category": "external", "summary": "Pepperl+Fuchs advisory overview at CERT@VDE", "url": "https://certvde.com/de/advisories/vendor/pepperl-fuchs/" }, { "category": "self", "summary": "VDE-2026-014: Pepperl+Fuchs: ICE2-* and ICE3-* are affected by multiple security vulnerabilities - HTML", "url": "https://certvde.com/en/advisories/VDE-2026-014" }, { "category": "self", "summary": "VDE-2026-014: Pepperl+Fuchs: ICE2-* and ICE3-* are affected by multiple security vulnerabilities - CSAF", "url": "https://pepperl-fuchs.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-014.json" } ], "title": "Pepperl+Fuchs: ICE2-* and ICE3-* are affected by multiple security vulnerabilities", "tracking": { "aliases": [ "VDE-2026-014" ], "current_release_date": "2026-09-16T08:00:00.000Z", "generator": { "date": "2026-09-15T15:48:38.728Z", "engine": { "name": "Secvisogram", "version": "2.6.11" } }, "id": "VDE-2026-014", "initial_release_date": "2026-09-16T08:00:00.000Z", "revision_history": [ { "date": "2026-09-16T08:00:00.000Z", "number": "1.0.0", "summary": "Initial release." } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "ICE2-8IOL1-G65L-V1D", "product": { "name": "ICE2-8IOL1-G65L-V1D", "product_id": "CSAFPID-11001", "product_identification_helper": { "model_numbers": [ "70118644" ] } } }, { "category": "product_name", "name": "ICE2-8IOL-G65L-V1D", "product": { "name": "ICE2-8IOL-G65L-V1D", "product_id": "CSAFPID-11002", "product_identification_helper": { "model_numbers": [ "70104877" ] } } }, { "category": "product_name", "name": "ICE2-8IOL-K45P-RJ45", "product": { "name": "ICE2-8IOL-K45P-RJ45", "product_id": "CSAFPID-11003", "product_identification_helper": { "model_numbers": [ "70108831", "70195316" ] } } }, { "category": "product_name", "name": "ICE2-8IOL-K45S-RJ45", "product": { "name": "ICE2-8IOL-K45S-RJ45", "product_id": "CSAFPID-11004", "product_identification_helper": { "model_numbers": [ "70104879", "70195318" ] } } }, { "category": "product_name", "name": "ICE3-8IOL1-G65L-V1D", "product": { "name": "ICE3-8IOL1-G65L-V1D", "product_id": "CSAFPID-11005", "product_identification_helper": { "model_numbers": [ "70118645" ] } } }, { "category": "product_name", "name": "ICE3-8IOL-G65L-V1D", "product": { "name": "ICE3-8IOL-G65L-V1D", "product_id": "CSAFPID-11006", "product_identification_helper": { "model_numbers": [ "70104876", "70129287" ] } } }, { "category": "product_name", "name": "ICE3-8IOL-G65L-V1D-Y", "product": { "name": "ICE3-8IOL-G65L-V1D-Y", "product_id": "CSAFPID-11007", "product_identification_helper": { "model_numbers": [ "70133474" ] } } }, { "category": "product_name", "name": "ICE3-8IOL-K45P-RJ45", "product": { "name": "ICE3-8IOL-K45P-RJ45", "product_id": "CSAFPID-11008", "product_identification_helper": { "model_numbers": [ "70108832", "70195319" ] } } }, { "category": "product_name", "name": "ICE3-8IOL-K45S-RJ45", "product": { "name": "ICE3-8IOL-K45S-RJ45", "product_id": "CSAFPID-11009", "product_identification_helper": { "model_numbers": [ "70104878", "70195322" ] } } } ], "category": "product_family", "name": "Hardware" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/>=1.0.0|<1.7.4", "product": { "name": "Firmware ICE2-* <1.7.4", "product_id": "CSAFPID-21001", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice2_firmware:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "1.7.8", "product": { "name": "Firmware ICE2-* 1.7.8", "product_id": "CSAFPID-22001", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice2_firmware:1.7.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "ICE2-*" }, { "branches": [ { "category": "product_version_range", "name": "vers:semver/>=1.0.0|<1.7.4", "product": { "name": "Firmware ICE3-* <1.7.4", "product_id": "CSAFPID-21002", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice3_firmware:*:*:*:*:*:*:*:*" } } }, { "category": "product_version", "name": "1.7.8", "product": { "name": "Firmware ICE3-* 1.7.8", "product_id": "CSAFPID-22002", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice3_firmware:1.7.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "ICE3-*" } ], "category": "product_family", "name": "Firmware" } ], "category": "vendor", "name": "Pepperl+Fuchs" } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ], "summary": "Affected Products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "summary": "Fixed Products." } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "Firmware ICE2-* <1.7.4 installed on ICE2-8IOL1-G65L-V1D", "product_id": "CSAFPID-31001", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice2_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "70118644" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE2-* <1.7.4 installed on ICE2-8IOL-G65L-V1D", "product_id": "CSAFPID-31002", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice2_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "70104877" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE2-* <1.7.4 installed on ICE2-8IOL-K45P-RJ45", "product_id": "CSAFPID-31003", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice2_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "70108831", "70195316" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE2-* <1.7.4 installed on ICE2-8IOL-K45S-RJ45", "product_id": "CSAFPID-31004", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice2_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "70104879", "70195318" ] } }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE3-* <1.7.4 installed on ICE3-8IOL1-G65L-V1D", "product_id": "CSAFPID-31005", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice3_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "70118645" ] } }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11005" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE3-* <1.7.4 installed on ICE3-8IOL-G65L-V1D", "product_id": "CSAFPID-31006", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice3_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "70104876", "70129287" ] } }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11006" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE3-* <1.7.4 installed on ICE3-8IOL-G65L-V1D-Y", "product_id": "CSAFPID-31007", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice3_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "70133474" ] } }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11007" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE3-* <1.7.4 installed on ICE3-8IOL-K45P-RJ45", "product_id": "CSAFPID-31008", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice3_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "70108832", "70195319" ] } }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11008" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE3-* <1.7.4 installed on ICE3-8IOL-K45S-RJ45", "product_id": "CSAFPID-31009", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice3_firmware:*:*:*:*:*:*:*:*", "model_numbers": [ "70104878", "70195322" ] } }, "product_reference": "CSAFPID-21002", "relates_to_product_reference": "CSAFPID-11009" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE2-* 1.7.8 installed on ICE2-8IOL1-G65L-V1D", "product_id": "CSAFPID-32001", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice2_firmware:1.7.8:*:*:*:*:*:*:*", "model_numbers": [ "70118644" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE2-* 1.7.8 installed on ICE2-8IOL-G65L-V1D", "product_id": "CSAFPID-32002", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice2_firmware:1.7.8:*:*:*:*:*:*:*", "model_numbers": [ "70104877" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE2-* 1.7.8 installed on ICE2-8IOL-K45P-RJ45", "product_id": "CSAFPID-32003", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice2_firmware:1.7.8:*:*:*:*:*:*:*", "model_numbers": [ "70108831", "70195316" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11003" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE2-* 1.7.8 installed on ICE2-8IOL-K45S-RJ45", "product_id": "CSAFPID-32004", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice2_firmware:1.7.8:*:*:*:*:*:*:*", "model_numbers": [ "70104879", "70195318" ] } }, "product_reference": "CSAFPID-22001", "relates_to_product_reference": "CSAFPID-11004" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE3-* 1.7.8 installed on ICE3-8IOL1-G65L-V1D", "product_id": "CSAFPID-32005", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice3_firmware:1.7.8:*:*:*:*:*:*:*", "model_numbers": [ "70118645" ] } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11005" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE3-* 1.7.8 installed on ICE3-8IOL-G65L-V1D", "product_id": "CSAFPID-32006", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice3_firmware:1.7.8:*:*:*:*:*:*:*", "model_numbers": [ "70104876", "70129287" ] } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11006" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE3-* 1.7.8 installed on ICE3-8IOL-G65L-V1D-Y", "product_id": "CSAFPID-32007", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice3_firmware:1.7.8:*:*:*:*:*:*:*", "model_numbers": [ "70133474" ] } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11007" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE3-* 1.7.8 installed on ICE3-8IOL-K45P-RJ45", "product_id": "CSAFPID-32008", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice3_firmware:1.7.8:*:*:*:*:*:*:*", "model_numbers": [ "70108832", "70195319" ] } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11008" }, { "category": "installed_on", "full_product_name": { "name": "Firmware ICE3-* 1.7.8 installed on ICE3-8IOL-K45S-RJ45", "product_id": "CSAFPID-32009", "product_identification_helper": { "cpe": "cpe:2.3:o:pepperl_fuchs:ice3_firmware:1.7.8:*:*:*:*:*:*:*", "model_numbers": [ "70104878", "70195322" ] } }, "product_reference": "CSAFPID-22002", "relates_to_product_reference": "CSAFPID-11009" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-27565", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Remote code execution via uploading a malicious IODD file" }, { "acknowledgments": [ { "names": [ "Gabriele Quagliarella" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27564", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.2, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 7.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection via PUT in /api/datastorage/data" }, { "acknowledgments": [ { "names": [ "Gabriele Quagliarella" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27563", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.2, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 7.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection via GET in /api/datastorage/data" }, { "acknowledgments": [ { "names": [ "Gabriele Quagliarella" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27562", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.2, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 7.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection via PUT in /api/iodd/config" }, { "acknowledgments": [ { "names": [ "Gabriele Quagliarella" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27561", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.2, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 7.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection via GET in /api/iodd/config" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27560", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.2, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 7.2, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection via DELETE in /api/status/data" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27559", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection via GET in /api/status/data" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27558", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27557", "cwe": { "id": "CWE-35", "name": "Path Traversal: '.../...//'" }, "notes": [ { "audience": "all", "category": "description", "text": "An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Path Traversal in /index.php/view_uploaded_iodd_file" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27556", "cwe": { "id": "CWE-98", "name": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')" }, "notes": [ { "audience": "all", "category": "description", "text": "A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Local File Inclusion in /index.php/ajax/save_iodd_parameters" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27555", "cwe": { "id": "CWE-98", "name": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')" }, "notes": [ { "audience": "all", "category": "description", "text": "A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Local File Inclusion in /index.php/ajax/get_iodd_port_info" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27554", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection in /index.php/ajax/save_iodd_parameters" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27553", "cwe": { "id": "CWE-497", "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere" }, "notes": [ { "audience": "all", "category": "description", "text": "A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "environmentalScore": 6.5, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 6.5, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Information Disclosure via Schema Path Manipulation" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27552", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "audience": "all", "category": "description", "text": "A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 8.1, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.1, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Unauthorized IODD File Upload due to Improper Authorization" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27551", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection in /index.php/ajax/parameterManage" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27550", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection in Field_Shadow_Password Class" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27549", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection in /index.php/attached_devices_tab/do_upload" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27548", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection in /index.php/ajax/get_iodd_port_info" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27547", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "audience": "all", "category": "description", "text": "A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Command Injection in /index.php/ajax/get_iodd_menu_info" }, { "acknowledgments": [ { "names": [ "Luca Borzacchiello" ], "organization": "Nozomi Networks", "summary": "reporting" } ], "cve": "CVE-2026-27546", "cwe": { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel" }, "notes": [ { "audience": "all", "category": "description", "text": "An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.", "title": "CVE Description" } ], "product_status": { "fixed": [ "CSAFPID-32001", "CSAFPID-32002", "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] }, "remediations": [ { "category": "vendor_fix", "details": "Install update 1.7.8.", "group_ids": [ "CSAFGID-0001" ], "url": "https://pepperl-fuchs.com/cybersecurity" }, { "category": "mitigation", "details": "Disable the webserver on the device or protect the access to the device by a firewall.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009" ] } ], "title": "Authentication Bypass in _account_log" } ] }