Command Injection in Attached Devices Endpoint

CVE-2026-27558 is a high-severity command injection vulnerability discovered within a web-based administrative interface, specifically affecting the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint. This flaw allows a remote attacker who has already obtained low-privileged operator-level credentials to inject arbitrary system commands. Because the application processes these requests with elevated privileges, the successful exploitation of this vulnerability results in full system compromise, granting the attacker root-level access to the underlying host. This vulnerability is significant due to the combination of low entry requirements (valid operator account) and maximum impact (root execution). Defenders should focus on monitoring for unauthorized or anomalous POST requests to the specified endpoint and auditing administrative session activity.

Impact

Successful exploitation of CVE-2026-27558 grants an attacker root-level execution on the targeted device. This provides full control over the appliance, including the ability to exfiltrate sensitive configuration data, modify system files, pivot to internal networks, or deploy persistent backdoors. The vulnerability specifically targets the device's web management interface, potentially impacting any organization relying on the affected hardware for network management or storage orchestration.

Recommendation

Prioritized actions for security teams:

• Audit logs for HTTP POST requests to "/index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files" and verify if they originate from authorized administrative sessions.
• Review all active operator-level accounts for signs of credential compromise or unauthorized usage patterns.
• Implement strict ingress filtering to the web management interface to restrict access to known, trusted management subnets.
• Apply patches provided by the vendor immediately upon release to address the improper input sanitization in the affected endpoint.