# cve.now: Pepperl+fuchs

The newest entries naming Pepperl+fuchs as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-27565](https://cve.now/CVE-2026-27565.md): Remote code execution via uploading a malicious IODD file (CVSS 9.8)
- [CVE-2026-27564](https://cve.now/CVE-2026-27564.md): Command Injection via PUT in /api/datastorage/data (CVSS 7.2)
- [CVE-2026-27563](https://cve.now/CVE-2026-27563.md): Command Injection via GET in /api/datastorage/data (CVSS 7.2)
- [CVE-2026-27562](https://cve.now/CVE-2026-27562.md): Command Injection via PUT in /api/iodd/config (CVSS 7.2)
- [CVE-2026-27561](https://cve.now/CVE-2026-27561.md): Command Injection via GET in /api/iodd/config (CVSS 7.2)
- [CVE-2026-27560](https://cve.now/CVE-2026-27560.md): Command Injection via DELETE in /api/status/data (CVSS 7.2)
- [CVE-2026-27559](https://cve.now/CVE-2026-27559.md): Command Injection via GET in /api/status/data (CVSS 8.8)
- [CVE-2026-27558](https://cve.now/CVE-2026-27558.md): Command Injection in /index.php/attached\_devices\_tab/ajax\_remove\_uploaded\_iodd\_files (CVSS 8.8)
- [CVE-2026-27557](https://cve.now/CVE-2026-27557.md): Path Traversal in /index.php/view\_uploaded\_iodd\_file (CVSS 7.5)
- [CVE-2026-27556](https://cve.now/CVE-2026-27556.md): Local File Inclusion in /index.php/ajax/save\_iodd\_parameters (CVSS 8.8)
- [CVE-2026-27555](https://cve.now/CVE-2026-27555.md): Local File Inclusion in /index.php/ajax/get\_iodd\_port\_info (CVSS 8.8)
- [CVE-2026-27554](https://cve.now/CVE-2026-27554.md): Command Injection in /index.php/ajax/save\_iodd\_parameters (CVSS 8.8)
- [CVE-2026-27553](https://cve.now/CVE-2026-27553.md): Information Disclosure via Schema Path Manipulation (CVSS 6.5)
- [CVE-2026-27552](https://cve.now/CVE-2026-27552.md): Unauthorized IODD File Upload due to Improper Authorization (CVSS 8.1)
- [CVE-2026-27551](https://cve.now/CVE-2026-27551.md): Command Injection in /index.php/ajax/parameterManage (CVSS 8.8)
- [CVE-2026-27550](https://cve.now/CVE-2026-27550.md): Command Injection in Field\_Shadow\_Password Class (CVSS 8.8)
- [CVE-2026-27549](https://cve.now/CVE-2026-27549.md): Command Injection in /index.php/attached\_devices\_tab/do\_upload (CVSS 8.8)
- [CVE-2026-27548](https://cve.now/CVE-2026-27548.md): Command Injection in /index.php/ajax/get\_iodd\_port\_info (CVSS 8.8)
- [CVE-2026-27547](https://cve.now/CVE-2026-27547.md): Command Injection in /index.php/ajax/get\_iodd\_menu\_info (CVSS 8.8)
- [CVE-2026-27546](https://cve.now/CVE-2026-27546.md): Authentication Bypass in \_account\_log (CVSS 9.8)
- [CVE-2025-41655](https://cve.now/CVE-2025-41655.md): PEPPERL+FUCHS: Attacker can cause a DoS via URL (CVSS 7.5)
- [CVE-2025-41654](https://cve.now/CVE-2025-41654.md): PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by information disclosure via the SNMP protocol (CVSS 8.2)
- [CVE-2025-1985](https://cve.now/CVE-2025-1985.md): PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerability (CVSS 6.1)
- [CVE-2024-38502](https://cve.now/CVE-2024-38502.md): Pepperl+Fuchs: Device Master ICDM-RX/\* XSS vulnerability allows stored XSS (CVSS 7.1)
- [CVE-2024-38501](https://cve.now/CVE-2024-38501.md): Pepperl+Fuchs: Device Master ICDM-RX/\* XSS vulnerability allows HTML injection (CVSS 6.1)
- [CVE-2024-5849](https://cve.now/CVE-2024-5849.md): Pepperl+Fuchs: Device Master ICDM-RX/\* XSS vulnerability allows reflected XSS (CVSS 7.1)
- [CVE-2024-6422](https://cve.now/CVE-2024-6422.md): Pepperl+Fuchs: OIT Products can be manipulated via unintended Telnet access (CVSS 9.8)
- [CVE-2024-6421](https://cve.now/CVE-2024-6421.md): Pepperl+Fuchs: Incorrectly configured FTP-Server in OIT Products (CVSS 7.5)
- [CVE-2021-20988](https://cve.now/CVE-2021-20988.md): Hilscher rcX RTOS: Wrong handling of the UDP checksum (CVSS 8.6)
- [CVE-2020-12504](https://cve.now/CVE-2020-12504.md): Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products (CVSS 9.8)
- [CVE-2020-12503](https://cve.now/CVE-2020-12503.md): Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products (CVSS 7.2)
- [CVE-2020-12502](https://cve.now/CVE-2020-12502.md): Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products (CVSS 8.8)
- [CVE-2020-12501](https://cve.now/CVE-2020-12501.md): Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products (CVSS 9.8)
- [CVE-2020-12500](https://cve.now/CVE-2020-12500.md): Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pepperl-fuchs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.