CVE-2026-27556

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A low-privileged remote attacker can exploit a local file inclusion (LFI) vulnerability—a flaw that allows an attacker to read or execute files on the server—via the '/index.php/ajax/save iodd parameters' endpoint. By using a valid operator cookie, the attacker can execute arbitrary PHP code on the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.