CVE-2026-27557
HighCVSS 7.5Summary
An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint, allowing the SSH server's private keys to be read.
Risk Assessment
Exposure of SSH private keys could allow the attacker to impersonate the server, intercept sessions, or gain further unauthorized access to the system.
Recommendation
Patch the vulnerability immediately, restrict access to the endpoint, and rotate SSH keys if compromise is suspected.
Other vulnerabilities in Device
See all- CVE-2026-27559High
A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27558High
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27556High
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie, allowing execution of arbitrary PHP code on the device.
- CVE-2026-27555High
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie, allowing execution of arbitrary PHP code on the device.
- CVE-2026-27554High
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27552High
A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.
- CVE-2026-27551High
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27550High
A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27549High
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-22910High
The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access. This represents a high risk to the integrity of the system.
Original NVD description (English source)
An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.