Certvde: 15 Vulnerabilities Disclosed, Including Critical Remote Root Access Flaws
A batch of 15 Certvde vulnerabilities, including two critical flaws, were disclosed on September 16, 2026, with several allowing unauthenticated remote attackers to gain root privileges.
Key findings
- Fifteen Certvde vulnerabilities disclosed on September 16, 2026, including two critical flaws.
- Critical CVE-2026-27565 allows unauthenticated root shell execution via malicious file upload.
- CVE-2026-27546 enables unauthenticated administrative access through an authentication bypass.
- Multiple command injection vulnerabilities allow root privilege escalation for low and high-privileged attackers.
- Path traversal and local file inclusion flaws enable sensitive data exposure and arbitrary code execution.
On September 16, 2026, a significant batch of 15 vulnerabilities was disclosed for Certvde products, with a critical flaw allowing unauthenticated remote attackers to gain root privileges. This disclosure event highlights severe security weaknesses that could lead to complete device compromise.
Several vulnerabilities revolve around command injection, enabling attackers to execute commands with root privileges. These include:
- CVE-2026-27564, CVE-2026-27563, and CVE-2026-27560, which affect the
/api/datastorage/dataand/api/status/dataendpoints, respectively, and require high privileges for exploitation via PUT, GET, or DELETE requests. - CVE-2026-27559, CVE-2026-27558, CVE-2026-27554, CVE-2026-27550, CVE-2026-27548, and CVE-2026-27547, which are exploitable by low-privileged attackers through various API endpoints like
/api/status/data,/index.php/ajax/save_iodd_parameters,Field_Shadow_Password,/index.php/ajax/get_iodd_port_info, and/index.php/ajax/get_iodd_menu_info, all leading to root command execution.
A particularly dangerous vulnerability, CVE-2026-27565, allows an unauthenticated remote attacker to upload a malicious IODD file, leading to the execution of a root shell script that persists even after reboots. Another critical flaw, CVE-2026-27546, bypasses authentication in the _account_log function, enabling unauthenticated attackers to log in as an administrator.
Beyond command injection, other vulnerabilities include path traversal (CVE-2026-27557), which could allow an attacker to read sensitive SSH private keys, and local file inclusion (CVE-2026-27556, CVE-2026-27555), enabling arbitrary PHP code execution. Additionally, CVE-2026-27553, a medium-severity vulnerability, allows a low-privileged attacker to disclose all user password hashes by manipulating a schema path parameter.
The full impact of these vulnerabilities could be severe, ranging from unauthorized code execution and persistent root access to sensitive data exposure and complete administrative control. Users are strongly advised to consult Certvde's official advisories for specific mitigation steps and patch information.
This coordinated disclosure of 15 vulnerabilities underscores the critical need for prompt patching and security reviews for Certvde products. The prevalence of command injection and authentication bypass flaws indicates a systemic issue that requires immediate attention from administrators to prevent potential widespread compromise. Users should prioritize updating their systems to the latest available versions to protect against these threats.