CVE-2026-27561: Command Injection via GET in /api/iodd/config
Published Sep 16, 2026
·Updated
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.
Event History
Sep 16, 2026
CVE Published
via MITRE·07:51 AM
Data Sourced
via MITRE·07:51 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
A remote attacker who has admin credentials can exploit it. The provided data does not indicate that unauthenticated or lower-privileged users can do so.
2
What access does successful exploitation provide?
Successful exploitation allows execution of commands with root privileges on the affected device. This can impact confidentiality, integrity, and availability.
3
Which interface is involved in exploitation?
The vulnerable interface is the /api/iodd/config endpoint, which can be targeted using a crafted GET request.