Phoenix Contact Iol Ma8 Pn Di8 vulnerabilities

CVE-2026-27546 [CRITICAL] CWE-288 CVE-2026-27546: An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.

CVE-2026-27559 [HIGH] CWE-78 CVE-2026-27559: A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/da A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device.

CVE-2026-27550 [HIGH] CWE-78 CVE-2026-27550: A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_P A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with root privileges on the device.

CVE-2026-27565 [CRITICAL] CWE-78 CVE-2026-27565: An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot.

CVE-2026-27551 [HIGH] CWE-78 CVE-2026-27551: A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/aja A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.

CVE-2026-27549 [HIGH] CWE-78 CVE-2026-27549: A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/att A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.

CVE-2026-27558 [HIGH] CWE-78 CVE-2026-27558: A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/att A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the device.

CVE-2026-27554 [HIGH] CWE-78 CVE-2026-27554: A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/aja A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.

CVE-2026-27547 [HIGH] CWE-78 CVE-2026-27547: A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/aja A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device.

CVE-2026-27548 [HIGH] CWE-78 CVE-2026-27548: A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/aja A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.

CVE-2026-27556 [HIGH] CWE-98 CVE-2026-27556: A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.

CVE-2026-27564 [HIGH] CWE-78 CVE-2026-27564: A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastor A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device.

CVE-2026-27555 [HIGH] CWE-98 CVE-2026-27555: A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.

CVE-2026-27560 [HIGH] CWE-78 CVE-2026-27560: A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/d A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device.

CVE-2026-27561 [HIGH] CWE-78 CVE-2026-27561: A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/con A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.

CVE-2026-27562 [HIGH] CWE-78 CVE-2026-27562: A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/con A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device.

CVE-2026-27563 [HIGH] CWE-78 CVE-2026-27563: A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastor A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.

CVE-2026-27557 [HIGH] CWE-35 CVE-2026-27557: An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.

CVE-2026-27552 [HIGH] CWE-863 CVE-2026-27552: A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devic A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.

CVE-2026-27553 [MEDIUM] CWE-497 CVE-2026-27553: A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnost A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes.