CVE-2026-27564

Command Injection via PUT in /api/datastorage/data

State: Published
Severity: 7.2 High
Published: Sep 16, 2026
Updated: Sep 16, 2026
Reserved: Feb 20, 2026

Description

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
ICE2-8IOL1-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE2-8IOL-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE2-8IOL-K45P-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE2-8IOL-K45S-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL1-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-G65L-V1D-YPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-K45P-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-K45S-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
IOL MA8 PN DI8Phoenix Contact	1.0.0 to before 1.7.4Affected
IOL MA8 EIP DI8Phoenix Contact	1.0.0 to before 1.7.4Affected
YL212CEI8M1IOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected
YN115CEI8RPIOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected
YL212CPN8M1IOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected
YN115CPN8RPIOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.