Vendor

    Carlo Gavazzi Automation

    22 known vulnerabilities in products by Carlo Gavazzi Automation, 0 of them actively exploited (CISA KEV).

    Key figures

    22

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Carlo Gavazzi Automation
    HighCVE-2026-27559

    Command Injection via GET in /api/status/data

    also in 11 other products

    		8.8
    HighCVE-2026-27558

    Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files

    also in 11 other products

    		8.8
    HighCVE-2026-27554

    Command Injection in /index.php/ajax/save_iodd_parameters

    also in 11 other products

    		8.8
    HighCVE-2026-27551

    Command Injection in /index.php/ajax/parameterManage

    also in 11 other products

    		8.8
    HighCVE-2026-27550

    Command Injection in Field_Shadow_Password Class

    also in 11 other products

    		8.8
    HighCVE-2026-27548

    Command Injection in /index.php/ajax/get_iodd_port_info

    also in 11 other products

    		8.8
    HighCVE-2026-27547

    Command Injection in /index.php/ajax/get_iodd_menu_info

    also in 11 other products

    		8.8
    HighCVE-2026-27549

    Command Injection in /index.php/attached_devices_tab/do_upload

    also in 11 other products

    		8.8
    HighCVE-2026-27564

    Command Injection via PUT in /api/datastorage/data

    also in 11 other products

    		7.2
    HighCVE-2026-27563

    Command Injection via GET in /api/datastorage/data

    also in 11 other products

    		7.2
    HighCVE-2026-27562

    Command Injection via PUT in /api/iodd/config

    also in 11 other products

    		7.2
    HighCVE-2026-27561

    Command Injection via GET in /api/iodd/config

    also in 11 other products

    		7.2
    HighCVE-2026-27560

    Command Injection via DELETE in /api/status/data

    also in 11 other products

    		7.2
    CriticalCVE-2026-27546

    Authentication Bypass in _account_log

    also in 11 other products

    		9.8
    CriticalCVE-2026-27565

    Remote code execution via uploading a malicious IODD file

    also in 11 other products

    		9.8
    HighCVE-2026-27556

    Local File Inclusion in /index.php/ajax/save_iodd_parameters

    also in 11 other products

    		8.8
    HighCVE-2026-27555

    Local File Inclusion in /index.php/ajax/get_iodd_port_info

    also in 11 other products

    		8.8
    HighCVE-2026-27557

    Path Traversal in /index.php/view_uploaded_iodd_file

    also in 11 other products

    		7.5
    HighCVE-2026-27552

    Unauthorized IODD File Upload due to Improper Authorization

    also in 11 other products

    		8.1
    MediumCVE-2026-27553

    Information Disclosure via Schema Path Manipulation

    also in 11 other products

    		6.5
    Not ratedCVE-2012-6428

    Carlo Gavazzi EOS Box Hard-Coded Credentials

    also in 1 other product

    		—
    Not ratedCVE-2012-6427

    Carlo Gavazzi EOS Box SQL Injection

    also in 1 other product

    		—

    Products

    Products by Carlo Gavazzi Automation
    Yl212cei8m1io200
    Yl212cpn8m1io200
    Yn115cei8rpio200
    Yn115cpn8rpio200