Phoenix Contact: Multiple vulnerabilities in the firmware of IOL MA8 EIP DI8 and IOL MA8 PN DI8 devices
The firmware of IOL MA8 EIP DI8 and IOL MA8 PN DI8 devices is affected by security vulnerabilities that can be used to bypass authentication. Code can be executed on the devices through command injection and local file inclusion. Path traversal and modified schemata can be used to read sensitive information such as password hashes or private keys from the devices.
describes (20)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-27565US | critical9.8 | — | ||
An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboo… | ||||
| CVE-2026-27564US | high7.2 | — | ||
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execu… | ||||
| CVE-2026-27563US | high7.2 | — | ||
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowi… | ||||
| CVE-2026-27562US | high7.2 | — | ||
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing ex… | ||||
| CVE-2026-27561US | high7.2 | — | ||
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing ex… | ||||
| CVE-2026-27560US | high7.2 | — | ||
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing… | ||||
| CVE-2026-27559US | high8.8 | — | ||
A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing exec… | ||||
| CVE-2026-27558US | high8.8 | — | ||
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator creden… | ||||
| CVE-2026-27557US | high7.5 | — | ||
An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read. | ||||
| CVE-2026-27556US | high8.8 | — | ||
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execut… | ||||
| CVE-2026-27555US | high8.8 | — | ||
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of… | ||||
| CVE-2026-27554US | high8.8 | — | ||
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of… | ||||
| CVE-2026-27553US | medium6.5 | — | ||
A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclos… | ||||
| CVE-2026-27552US | high8.1OT elevated | — | ||
A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially alteri… | ||||
| CVE-2026-27551US | high8.8 | — | ||
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands… | ||||
| CVE-2026-27550US | high8.8 | — | ||
A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with roo… | ||||
| CVE-2026-27549US | high8.8 | — | ||
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing executi… | ||||
| CVE-2026-27548US | high8.8 | — | ||
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execut… | ||||
| CVE-2026-27547US | high8.8 | — | ||
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing… | ||||
| CVE-2026-27546US | critical9.8OT elevated | — | ||
An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured. | ||||
references
External citations — patches, advisories, analysis.
- Phoenix Contact advisory overview at CERT@VDEexternal
- VDE-2026-027: Phoenix Contact: Multiple vulnerabilities in the firmware of IOL MA8 EIP DI8 and IOL MA8 PN DI8 devices - HTMLself
- Phoenix Contact application noteexternal
- PCSA-2026-00003external
- VDE-2026-027: Phoenix Contact: Multiple vulnerabilities in the firmware of IOL MA8 EIP DI8 and IOL MA8 PN DI8 devices - CSAFself
remediations (41)
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Mitigation
Disable the webserver on the device or protect the access to the device by a firewall.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- Fixed
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- FixedFirmware <1.7.4 installed on IOL MA8 EIP DI8
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
- FixedFirmware <1.7.4 installed on IOL MA8 PN DI8
Phoenix Contact strongly recommends to update affected devices to firmware version 1.7.8.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan