CVE-2026-27556: fallo de gravedad alta en Carlo Gavazzi Automation YL212CEI8M1IO
Local File Inclusion in /index.php/ajax/save_iodd_parameters
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.9%
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Carlo Gavazzi Automation · YL212CEI8M1IOCarlo Gavazzi Automation · YL212CPN8M1IOCarlo Gavazzi Automation · YN115CEI8RPIOCarlo Gavazzi Automation · YN115CPN8RPIOPepperl+Fuchs · ICE2-8IOL1-G65L-V1DPepperl+Fuchs · ICE2-8IOL-G65L-V1DPepperl+Fuchs · ICE2-8IOL-K45P-RJ45Pepperl+Fuchs · ICE2-8IOL-K45S-RJ45Pepperl+Fuchs · ICE3-8IOL1-G65L-V1DPepperl+Fuchs · ICE3-8IOL-G65L-V1DPepperl+Fuchs · ICE3-8IOL-G65L-V1D-YPepperl+Fuchs · ICE3-8IOL-K45P-RJ45Pepperl+Fuchs · ICE3-8IOL-K45S-RJ45Phoenix Contact · IOL MA8 EIP DI8Phoenix Contact · IOL MA8 PN DI8CVEs relacionadas — Carlo Gavazzi Automation YL212CEI8M1IO
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-27559HIGHCommand Injection via GET in /api/status/dataEPSS 2.9%CVE-2026-27558HIGHCommand Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_filesEPSS 2.9%CVE-2026-27554HIGHCommand Injection in /index.php/ajax/save_iodd_parametersEPSS 2.9%CVE-2026-27551HIGHCommand Injection in /index.php/ajax/parameterManageEPSS 2.9%CVE-2026-27550HIGHCommand Injection in Field_Shadow_Password ClassEPSS 2.9%CVE-2026-27549HIGHCommand Injection in /index.php/attached_devices_tab/do_uploadEPSS 2.9%