CVE-2026-27555: PHP Application RCE Vulnerability

CVE-2026-27555 Overview

CVE-2026-27555 is a local file inclusion (LFI) vulnerability affecting the /index.php/ajax/get_iodd_port_info endpoint. A low-privileged remote attacker holding a valid user cookie can exploit the flaw to include and execute arbitrary PHP code on the device. The weakness is classified under CWE-98, which covers improper control of filename for include/require statements in PHP. Successful exploitation grants full read, write, and execution impact on the affected system. The vulnerability is tracked by CERT-VDE across three related advisories.

Critical Impact
Authenticated attackers can achieve arbitrary PHP code execution over the network, leading to complete compromise of confidentiality, integrity, and availability on the affected device.

Affected Products

Devices exposing the /index.php/ajax/get_iodd_port_info PHP endpoint (see CERT-VDE advisories)
Product details listed in CERT-VDE Advisory VDE-2026-014
Additional affected products in CERT-VDE Advisory VDE-2026-027 and CERT-VDE Advisory VDE-2026-028

Discovery Timeline

2026-09-16 - CVE-2026-27555 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-27555

Vulnerability Analysis

The vulnerability resides in the get_iodd_port_info AJAX handler exposed through /index.php/ajax/get_iodd_port_info. The handler passes attacker-controlled input into a PHP include or require statement without adequate validation. An attacker with a valid session cookie can point the include target at a PHP file already on disk or delivered through log poisoning, session files, or upload mechanisms. Once included, the PHP interpreter executes the referenced code with the privileges of the web application. The result is arbitrary code execution on the device, which typically grants the attacker equivalent access to the web service account.

Root Cause

The root cause is improper control of filename passed to a PHP include directive, categorized as CWE-98. The endpoint concatenates user-supplied data into a filesystem path used for dynamic file inclusion. No allowlist, canonicalization, or path restriction limits which files the interpreter can load. Because PHP evaluates included files as code, any file containing PHP directives becomes an execution primitive.

Attack Vector

Exploitation requires network access to the web interface and a valid authenticated user cookie. The attacker sends a crafted HTTP request to /index.php/ajax/get_iodd_port_info with a parameter that manipulates the include path. Traversal sequences or absolute paths redirect the include to attacker-controlled content. Because privileges required are low, any legitimate user account is sufficient to trigger the flaw. Refer to the CERT-VDE advisories for endpoint-specific parameter details.

Detection Methods for CVE-2026-27555

Indicators of Compromise

HTTP requests to /index.php/ajax/get_iodd_port_info containing path traversal sequences such as ../, absolute filesystem paths, or references to log, session, or upload directories.
Unexpected PHP processes spawning shell interpreters, network utilities, or reverse-shell binaries from the web server context.
New or modified files in web-accessible directories that were not deployed by the vendor.

Detection Strategies

Inspect web server access logs for authenticated requests to the get_iodd_port_info endpoint carrying suspicious query or POST parameters.
Correlate authenticated session activity with unusual file reads outside the application document root.
Deploy endpoint behavioral monitoring on the affected device to flag PHP-initiated child processes that deviate from baseline application behavior.

Monitoring Recommendations

Enable verbose logging on the web server and forward logs to a centralized platform for retention and correlation.
Alert on authenticated sessions issuing repeated requests to the vulnerable endpoint within short time windows.
Track outbound network connections initiated by the web service account to detect post-exploitation callbacks.

How to Mitigate CVE-2026-27555

Immediate Actions Required

Apply the vendor firmware or software updates referenced in CERT-VDE Advisory VDE-2026-014, VDE-2026-027, and VDE-2026-028 as soon as they are available.
Restrict network access to the management web interface to trusted administrative networks only.
Rotate credentials for all user accounts and invalidate active sessions on affected devices.

Patch Information

Refer to the three CERT-VDE advisories for vendor-supplied patched firmware or software versions. Because the enriched CVE data does not list specific fixed versions, administrators should consult the linked advisories directly to confirm the applicable release for their product model.

Workarounds

Place the affected web interface behind a VPN or reverse proxy that enforces additional authentication and IP allowlisting.
Remove or disable low-privileged user accounts that do not require access to the management interface.
Monitor and alert on any access to /index.php/ajax/get_iodd_port_info until patches are applied.