CVE-2026-27552: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D, заобикаляне на вход

Описание

Оригинално описание

A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.

Засегнати продукти

• Pepperl+Fuchs ICE2-8IOL1-G65L-V1D: 1.0.0 преди 1.7.4
• Pepperl+Fuchs ICE2-8IOL-G65L-V1D: 1.0.0 преди 1.7.4
• Pepperl+Fuchs ICE2-8IOL-K45P-RJ45: 1.0.0 преди 1.7.4
• Pepperl+Fuchs ICE2-8IOL-K45S-RJ45: 1.0.0 преди 1.7.4
• Pepperl+Fuchs ICE3-8IOL1-G65L-V1D: 1.0.0 преди 1.7.4
• Pepperl+Fuchs ICE3-8IOL-G65L-V1D: 1.0.0 преди 1.7.4
• Pepperl+Fuchs ICE3-8IOL-G65L-V1D-Y: 1.0.0 преди 1.7.4
• Pepperl+Fuchs ICE3-8IOL-K45P-RJ45: 1.0.0 преди 1.7.4
• Pepperl+Fuchs ICE3-8IOL-K45S-RJ45: 1.0.0 преди 1.7.4
• Phoenix Contact IOL MA8 PN DI8: 1.0.0 преди 1.7.4
• Phoenix Contact IOL MA8 EIP DI8: 1.0.0 преди 1.7.4
• Carlo Gavazzi Automation YL212CEI8M1IO: 1.0.0 преди 1.7.4
• Carlo Gavazzi Automation YN115CEI8RPIO: 1.0.0 преди 1.7.4
• Carlo Gavazzi Automation YL212CPN8M1IO: 1.0.0 преди 1.7.4
• Carlo Gavazzi Automation YN115CPN8RPIO: 1.0.0 преди 1.7.4

Вид слабост

• CWE-863 Incorrect Authorization

История

Други уязвимости в Pepperl+Fuchs ICE2-8IOL1-G65L-V1D

• 9.8CVE-2026-27565
• 7.2CVE-2026-27564
• 7.2CVE-2026-27563
• 7.2CVE-2026-27562
• 7.2CVE-2026-27561

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-27552
• https://nvd.nist.gov/vuln/detail/CVE-2026-27552
• https://www.certvde.com/en/advisories/VDE-2026-014/
• https://www.certvde.com/en/advisories/VDE-2026-027/
• https://www.certvde.com/en/advisories/VDE-2026-028/