CVE-2026-27562: Command Injection via PUT in /api/iodd/config
Published Sep 16, 2026
·Updated
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device.
Event History
Sep 16, 2026
CVE Published
via MITRE·07:51 AM
Data Sourced
via MITRE·07:51 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be able to reach the device remotely and authenticate with admin credentials. No user interaction is required.
2
What is the potential impact after exploitation?
A successful attacker can execute commands with root privileges on the affected device, resulting in complete compromise of confidentiality, integrity, and availability.
3
How is the vulnerability triggered?
Exploitation involves sending a crafted PUT request to the /api/iodd/config endpoint while authenticated as an administrator.