EUVD-2026-80237
GHSA-426f-m78p-m3jc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Operator credentials required (PR:L) over the network (AV:N); root execution yields full C/I/A:H impact on the device with no scope change.
Primary rating from Vendor (CERTVDE).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.
AnalysisAI
Command injection via the PHP-based IODD parameter save endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link masters and OEM-equivalent devices allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. Affected hardware includes multiple ICE2 and ICE3 form-factor variants from Pepperl+Fuchs and the Phoenix Contact IOL MA8 PN DI8, with additional OEM-labeled variants covered under three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid operator-level credentials to the device's PHP web management interface - the CVSS PR:L metric confirms authentication is mandatory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the core risk: network-reachable, low-complexity exploitation requiring only operator-level credentials, yielding full root compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the applicable CERTVDE advisory for your device variant - VDE-2026-014, VDE-2026-027, or VDE-2026-028 at certvde.com - for vendor-released firmware updates; no patched version number was independently confirmed in the available source data, so direct vendor confirmation is required before deploying a fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL MA8 instances in your environment; audit operator account permissions and immediately restrict to only active personnel with documented business need; enable audit logging on affected devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today