Command Injection Vulnerability in Affected Product by Specific Vendor
CVE-2026-27547
8.8HIGH
What is CVE-2026-27547?
A command injection vulnerability exists within the /index.php/ajax/get_iodd_menu_info endpoint, allowing low-privileged remote attackers to exploit the system. By leveraging valid user or operator credentials, attackers can execute arbitrary commands with root privileges on the affected device, potentially compromising its integrity and security. Prompt action is recommended to mitigate potential risks associated with this vulnerability.
Affected Version(s)
ICE2-8IOL-G65L-V1D 1.0.0 < 1.7.4
ICE2-8IOL-K45P-RJ45 1.0.0 < 1.7.4
ICE2-8IOL-K45S-RJ45 1.0.0 < 1.7.4
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Gabriele Quagliarella from Nozomi Networks
Luca Borzacchiello from Nozomi Networks