CVE-2026-27557

published 2026-09-16

CVE-2026-27557: An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's…

Priority P3 53 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
carlo_gavazzi_automation	yl212cei8m1io	>= 1.0.0 < 1.7.4	1.7.4
carlo_gavazzi_automation	yl212cpn8m1io	>= 1.0.0 < 1.7.4	1.7.4
carlo_gavazzi_automation	yn115cei8rpio	>= 1.0.0 < 1.7.4	1.7.4
carlo_gavazzi_automation	yn115cpn8rpio	>= 1.0.0 < 1.7.4	1.7.4
pepperl+fuchs	ice2-8iol-g65l-v1d	>= 1.0.0 < 1.7.4	1.7.4
pepperl+fuchs	ice2-8iol-k45p-rj45	>= 1.0.0 < 1.7.4	1.7.4
pepperl+fuchs	ice2-8iol-k45s-rj45	>= 1.0.0 < 1.7.4	1.7.4
pepperl+fuchs	ice2-8iol1-g65l-v1d	>= 1.0.0 < 1.7.4	1.7.4
pepperl+fuchs	ice3-8iol-g65l-v1d	>= 1.0.0 < 1.7.4	1.7.4
pepperl+fuchs	ice3-8iol-g65l-v1d-y	>= 1.0.0 < 1.7.4	1.7.4
pepperl+fuchs	ice3-8iol-k45p-rj45	>= 1.0.0 < 1.7.4	1.7.4
pepperl+fuchs	ice3-8iol-k45s-rj45	>= 1.0.0 < 1.7.4	1.7.4
pepperl+fuchs	ice3-8iol1-g65l-v1d	>= 1.0.0 < 1.7.4	1.7.4
phoenix_contact	iol_ma8_eip_di8	>= 1.0.0 < 1.7.4	1.7.4
phoenix_contact	iol_ma8_pn_di8	>= 1.0.0 < 1.7.4	1.7.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-35