Luca Borzacchiello

A high-privileged remote attacker can execute commands with root privileges on the device. This is achieved by sending a PUT request to the '/api/datastorage/data' endpoint using admin credentials, which triggers a command injection. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server.

A high-privileged remote attacker can execute commands with root privileges on the device via a command injection flaw. This occurs when a crafted GET request is sent to the '/api/datastorage/data' endpoint using admin credentials.

A low-privileged remote attacker with operator credentials can execute commands with root privileges on the device. This is possible through a command injection flaw in the '/index.php/attached devices tab/ajax remove uploaded iodd files' endpoint.

A low-privileged remote attacker can exploit a local file inclusion (LFI) vulnerability—a flaw that allows an attacker to read or execute files on the server—via the '/index.php/ajax/save iodd parameters' endpoint. By using a valid operator cookie, the attacker can execute arbitrary PHP code on the device.

A low-privileged remote attacker can execute commands with root privileges on the device. This is achieved by sending a crafted GET request to the '/api/status/data' endpoint using valid user credentials, leading to command injection.

A high-privileged remote attacker can execute commands with root privileges on the device. This is achieved by sending a crafted PUT request to the '/api/iodd/config' endpoint using admin credentials, leading to command injection.

An unauthenticated remote attacker can exploit a path traversal vulnerability—a flaw that allows access to files and directories stored outside the intended folder—via the '/index.php/view uploaded iodd file' endpoint. This allows the attacker to read the private keys of the SSH server.

A low-privileged remote attacker with a valid user cookie can manipulate the `schema path` parameter in the '/index.php/diagnostics tab/ajax diag table rows' endpoint to disclose all user password hashes.

A low-privileged remote attacker can exploit improper authorization in the '/index.php/attached devices tab/do upload' endpoint to upload IODD files to the device. This action could potentially alter device behavior or cause system crashes.

A low-privileged remote attacker with valid user credentials can execute commands with root privileges on the device. This is possible through a command injection flaw in the '/index.php/ajax/parameterManage' endpoint. Command injection is a security issue where an attacker executes arbitrary operating system commands on a server via a vulnerable application.

A low-privileged remote attacker with operator credentials can execute commands with root privileges on the device. This is possible through a command injection flaw in the '/index.php/ajax/save iodd parameters' endpoint.

A low-privileged remote attacker can exploit a local file inclusion (LFI) vulnerability—a flaw that allows an attacker to read or include files on the server—via the '/index.php/ajax/get iodd port info' endpoint. By using a valid user cookie, the attacker can execute arbitrary PHP code on the device.

A high-privileged remote attacker can execute commands with root privileges on the device. This is achieved by sending a crafted DELETE request to the '/api/status/data' endpoint using admin credentials, leading to command injection.

A high-privileged remote attacker can execute commands with root privileges on the device via command injection. This occurs when a crafted GET request is sent to the '/api/iodd/config' endpoint using admin credentials.

An unauthenticated remote attacker can exploit an authentication bypass in the ` account log()` function to gain administrative access, regardless of whether accounts are properly configured.

A low-privileged remote attacker with operator credentials can execute commands with root privileges on the device. This is possible through a command injection flaw in the '/index.php/attached devices tab/do upload' endpoint. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server.

A low-privileged remote attacker with user or operator credentials can execute commands with root privileges on the device. This is possible through a command injection flaw in the '/index.php/ajax/get iodd port info' endpoint. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server.

A low-privileged remote attacker with valid user or operator credentials can execute commands with root privileges on the device. This is possible through a command injection flaw in the '/index.php/ajax/get iodd menu info' endpoint.

A low-privileged remote attacker can exploit a command injection vulnerability in the `Field Shadow Password` class. By using operator credentials, an attacker can execute commands with root privileges on the device. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server.

An unauthenticated remote attacker can upload a malicious IODD file, which allows for the placement and execution of a shell script with root privileges. This script persists and remains active after a system reboot.