Command Injection Vulnerability in Affected Vendor's Product
CVE-2026-27560
7.2HIGH
What is CVE-2026-27560?
A command injection vulnerability exists in the /api/status/data endpoint that could be exploited by a remote attacker with high privileges. By sending a specially crafted DELETE request with valid admin credentials, an attacker can execute arbitrary commands with root privileges on the affected device. This poses a significant risk, enabling unauthorized access and control over the system. It is crucial for users to ensure their systems are up to date and to implement best practices in securing API endpoints.
Affected Version(s)
ICE2-8IOL-G65L-V1D 1.0.0 < 1.7.4
ICE2-8IOL-K45P-RJ45 1.0.0 < 1.7.4
ICE2-8IOL-K45S-RJ45 1.0.0 < 1.7.4
References
CVSS V3.1
Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Gabriele Quagliarella from Nozomi Networks
Luca Borzacchiello from Nozomi Networks