Carlo Gavazzi Automation
- Total products in the ecosystem
- 5
- Total vulnerabilities (90 days)
- 20
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, Carlo Gavazzi Automation recorded 20 security vulnerabilities in the last 90 days across 4 products, including 19 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, YL212CEI8M1IO had the most security vulnerabilities in the Carlo Gavazzi Automation ecosystem, with 20 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-27565Root-level command execution via malicious IODD upload in Pepperl+Fuchs, Phoenix Contact, and Carlo Gavazzi Automation devicesCVE-2026-27564Command Injection via PUT in /api/datastorage/dataCVE-2026-27563Command Injection via GET in /api/datastorage/dataCVE-2026-27562Command Injection via PUT in /api/iodd/configCVE-2026-27561Command Injection via GET in /api/iodd/config| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-27565Root-level command execution via malicious IODD upload in Pepperl+Fuchs, Phoenix Contact, and Carlo Gavazzi Automation devices | Exploitation statusNot exploited | FixYes |
| Affected productYL212CEI8M1IO |
| Published09/16/2026 |
| SeverityCritical |
CVE-2026-27564Command Injection via PUT in /api/datastorage/data | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27563Command Injection via GET in /api/datastorage/data | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27562Command Injection via PUT in /api/iodd/config | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27561Command Injection via GET in /api/iodd/config | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27560Command Injection via DELETE in /api/status/data | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27559Command Injection via GET in /api/status/data | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27558Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27557Path Traversal in /index.php/view_uploaded_iodd_file | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27556Local File Inclusion in /index.php/ajax/save_iodd_parameters | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27555Local File Inclusion in /index.php/ajax/get_iodd_port_info | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27554Command Injection in /index.php/ajax/save_iodd_parameters | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27553Information Disclosure via Schema Path Manipulation | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityMedium |
|---|
CVE-2026-27552Unauthorized IODD File Upload due to Improper Authorization | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27551Command Injection in /index.php/ajax/parameterManage | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27550Command Injection in Field_Shadow_Password Class | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27549Command Injection in /index.php/attached_devices_tab/do_upload | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27548Command Injection in /index.php/ajax/get_iodd_port_info | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27547Command Injection in /index.php/ajax/get_iodd_menu_info | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-27546Authentication Bypass in _account_log | Exploitation statusNot exploited | FixYes | Affected productYL212CEI8M1IO | Published09/16/2026 | SeverityCritical |
|---|
CVE-2012-6428Carlo Gavazzi EOS Box Hard-Coded Credentials | Exploitation statusNot confirmed | FixYes | Affected productEOS-Box | Published12/23/2012 | SeverityHigh |
|---|
CVE-2012-6427Carlo Gavazzi EOS Box SQL Injection | Exploitation statusNot confirmed | FixYes | Affected productEOS-Box | Published12/23/2012 | SeverityHigh |
|---|
22 Results | Page 1 of 1