Pepperl+Fuchs
Vulnerability activity for Pepperl+Fuchs: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 20
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 20
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 9.8CriticalSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27565An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot.
- 7.2HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27564A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device.
- 7.2HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27563A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.
- 7.2HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27562A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device.
- 7.2HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27561A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.
- 7.2HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27560A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device.
- 8.8HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27559A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device.
- 8.8HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27558A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the device.
- 7.5HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Path traversal / file handlingCVE-2026-27557An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.
- 8.8HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Path traversal / file handlingCVE-2026-27556A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.
- 8.8HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Path traversal / file handlingCVE-2026-27555A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.
- 8.8HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27554A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.
- 6.5MediumSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Information disclosureCVE-2026-27553A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes.
- 8.1HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Auth bypass / access controlCVE-2026-27552A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.
- 8.8HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27551A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.
- 8.8HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27550A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with root privileges on the device.
- 8.8HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27549A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.
- 8.8HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27548A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.
- 8.8HighSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Code / command injectionCVE-2026-27547A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device.
- 9.8CriticalSep 16, 2026Pepperl+Fuchs ICE2-8IOL1-G65L-V1D Auth bypass / access controlCVE-2026-27546An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.
Top products
- ICE2-8IOL1-G65L-V1D20 CVEs in the last year, 2 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.