CVE-2026-27554: Command Injection in /index.php/ajax/save_iodd_parameters
Published Sep 16, 2026
·Updated
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/saveioddparameters endpoint using operator credentials allowing execution of commands with root privileges on the device.
Event History
Sep 16, 2026
CVE Published
via MITRE·07:49 AM
Data Sourced
via MITRE·07:49 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker needs remote access to the affected endpoint and valid operator-level credentials. No user interaction is required.
2
What level of impact can successful exploitation have?
Successful exploitation allows commands to be executed with root privileges on the device. This can result in full compromise of confidentiality, integrity, and availability.