CVE-2026-27558: Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files
Published Sep 16, 2026
·Updated
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/ajaxremoveuploadedioddfiles endpoint using operator credentials allowing execution of commands with root privileges on the device.
Event History
Sep 16, 2026
CVE Published
via MITRE·07:50 AM
Data Sourced
via MITRE·07:50 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker needs remote access and operator credentials. No user interaction is required, and the attack complexity is low.
2
What is the potential impact after successful exploitation?
An attacker can execute commands with root privileges on the affected device. This can compromise confidentiality, integrity, and availability.