EUVD-2026-80239
GHSA-fmvr-8vv5-53j5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible PHP endpoint with operator cookie required (PR:L); straightforward LFI exploitation (AC:L); full RCE yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (CERTVDE).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.
AnalysisAI
Remote code execution is achievable on Pepperl+Fuchs ICE2/ICE3-series IO-Link Master devices and the Phoenix Contact IOL MA8 via a local file inclusion flaw in the /index.php/ajax/save_iodd_parameters AJAX endpoint. An authenticated attacker holding a valid operator-level session cookie can supply a crafted filename parameter that causes the PHP runtime to include and execute an attacker-controlled file, yielding full device compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid operator-level session cookie for the device web interface - this is an authenticated vulnerability (PR:L per CVSS), not exploitable by unauthenticated network attackers; (2) network reachability to the device on its HTTP/HTTPS management port; (3) a mechanism to stage or reference an attacker-controlled PHP file accessible to the device's include path - this may involve a writable upload endpoint on the same device or a network path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 (High) score reflects an AV:N/AC:L/PR:L/UI:N vector - network-reachable, low complexity, low-privilege required, no user interaction - with full C/H/I/A impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the CERTVDE advisories at https://www.certvde.com/en/advisories/VDE-2026-014/, https://www.certvde.com/en/advisories/VDE-2026-027/, and https://www.certvde.com/en/advisories/VDE-2026-028/ for vendor-released firmware patches; exact patched versions are not independently confirmed from available data - treat any firmware update communicated by Pepperl+Fuchs or Phoenix Contact through these advisories as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL MA8 devices in production and document current operator account assignments and access patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-98 – PHP Remote File Inclusion
View allShare
External POC / Exploit Code
Leaving vuln.today