CVE-2026-27556

Local File Inclusion in /index.php/ajax/save_iodd_parameters

State: Published
Severity: 8.8 High
Published: Sep 16, 2026
Updated: Sep 16, 2026
Reserved: Feb 20, 2026

Description

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Affected Products

Product	Versions
ICE2-8IOL1-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE2-8IOL-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE2-8IOL-K45P-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE2-8IOL-K45S-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL1-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-G65L-V1D-YPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-K45P-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-K45S-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
IOL MA8 PN DI8Phoenix Contact	1.0.0 to before 1.7.4Affected
IOL MA8 EIP DI8Phoenix Contact	1.0.0 to before 1.7.4Affected
YL212CEI8M1IOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected
YN115CEI8RPIOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected
YL212CPN8M1IOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected
YN115CPN8RPIOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.