Remote Code Execution Vulnerability in ABC Software by XYZ Corp
CVE-2026-27553
6.5MEDIUM
What is CVE-2026-27553?
A low-privileged remote attacker can exploit a vulnerability in ABC Software by manipulating the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint. This exploitation occurs using a valid user cookie, which leads to the potential disclosure of all user password hashes. This access can pose serious security risks, allowing attackers to compromise user accounts and escalate their access privileges.
Affected Version(s)
ICE2-8IOL-G65L-V1D 1.0.0 < 1.7.4
ICE2-8IOL-K45P-RJ45 1.0.0 < 1.7.4
ICE2-8IOL-K45S-RJ45 1.0.0 < 1.7.4
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Gabriele Quagliarella from Nozomi Networks
Luca Borzacchiello from Nozomi Networks