Command Injection Vulnerability in Affected Device by CERTVDE
CVE-2026-27561
7.2HIGH
What is CVE-2026-27561?
A command injection vulnerability exists within the /api/iodd/config endpoint of certain devices. An authenticated attacker with elevated privileges can exploit this flaw by sending specially crafted GET requests, allowing them to execute arbitrary commands with root privileges on the affected device. This poses a significant security risk, as it can lead to unauthorized access and control over the system.
Affected Version(s)
ICE2-8IOL-G65L-V1D 1.0.0 < 1.7.4
ICE2-8IOL-K45P-RJ45 1.0.0 < 1.7.4
ICE2-8IOL-K45S-RJ45 1.0.0 < 1.7.4
References
CVSS V3.1
Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Gabriele Quagliarella from Nozomi Networks
Luca Borzacchiello from Nozomi Networks