CVE-2026-27552

Unauthorized IODD File Upload due to Improper Authorization

State: Published
Severity: 8.1 High
Published: Sep 16, 2026
Updated: Sep 16, 2026
Reserved: Feb 20, 2026

Description

A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	CERTVDE

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
ICE2-8IOL1-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE2-8IOL-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE2-8IOL-K45P-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE2-8IOL-K45S-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL1-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-G65L-V1D-YPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-K45P-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-K45S-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
IOL MA8 PN DI8Phoenix Contact	1.0.0 to before 1.7.4Affected
IOL MA8 EIP DI8Phoenix Contact	1.0.0 to before 1.7.4Affected
YL212CEI8M1IOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected
YN115CEI8RPIOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected
YL212CPN8M1IOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected
YN115CPN8RPIOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.