Pepperl+Fuchs vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-27565 An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges.Critical 9.8 · Sep 16, 2026
• CVE-2026-27564 A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credenHigh 7.2 · Sep 16, 2026
• CVE-2026-27563 A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admiHigh 7.2 · Sep 16, 2026
• CVE-2026-27562 A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin creHigh 7.2 · Sep 16, 2026
• CVE-2026-27561 A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin creHigh 7.2 · Sep 16, 2026
• CVE-2026-27560 A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin High 7.2 · Sep 16, 2026
• CVE-2026-27559 A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credeHigh 8.8 · Sep 16, 2026
• CVE-2026-27558 A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint uHigh 8.8 · Sep 16, 2026
• CVE-2026-27557 An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's privaHigh 7.5 · Sep 16, 2026
• CVE-2026-27556 A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator coHigh 8.8 · Sep 16, 2026
• CVE-2026-27555 A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie aHigh 8.8 · Sep 16, 2026
• CVE-2026-27554 A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials aHigh 8.8 · Sep 16, 2026
• CVE-2026-27552 A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the deviceHigh 8.1 · Sep 16, 2026
• CVE-2026-27551 A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing eHigh 8.8 · Sep 16, 2026
• CVE-2026-27550 A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution High 8.8 · Sep 16, 2026
• CVE-2026-27549 A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentiHigh 8.8 · Sep 16, 2026
• CVE-2026-27548 A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentHigh 8.8 · Sep 16, 2026
• CVE-2026-27547 A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator cHigh 8.8 · Sep 16, 2026
• CVE-2026-27546 An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly confCritical 9.8 · Sep 16, 2026
• CVE-2025-41655 An unauthenticated remote attacker can access a URL which causes the device to reboot.High 7.5 · May 26, 2025
• CVE-2025-41654 An unauthenticated remote attacker can access information about running processes via the SNMP protocol.High 8.2 · May 26, 2025
• CVE-2024-5849 An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once.High 7.1 · Aug 13, 2024
• CVE-2024-38502 An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.High 7.1 · Aug 13, 2024
• CVE-2024-6422 An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data.Critical 9.8 · Jul 10, 2024
• CVE-2024-6421 An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service.High 7.5 · Jul 10, 2024