Pepperl+Fuchs IO-Link CVE-2026-27546

Exploitation requires only network reachability to the affected device's management interface (the _account_log function); per CVSS AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special configuration needed - the bypass works even when accounts are properly configured. The practical limiting factor is network exposure: these IO-Link masters are industrial field devices normally expected on segmented OT networks, so real-world risk depends on whether the management interface is reachable by the attacker. No specific firmware version or non-default feature toggle is stated as a prerequisite in the available data.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) is internally consistent with the description: no authentication, no user interaction, low complexity, and full compromise of the device. There is no EPSS value, no CISA KEV listing, and no POC indicated in the input, so exploitation is currently theoretical from a public-intelligence standpoint - the high score derives from ease of exploitation, not from observed attacks. The main real-world mitigant is deployment context: these are OT/industrial devices typically expected to sit on segmented control networks rather than the open internet, so AV:N is technically accurate but realistic reachability depends on network exposure. Any mid-sized operator running these IO-Link masters on a reachable management network should nonetheless treat this as urgent, since a successful bypass yields complete administrative control of automation hardware. In short, this is a genuine high-priority flaw where exposure hinges on network segmentation rather than on attacker sophistication.

An attacker with network access to an IO-Link master's management interface sends a crafted request invoking the _account_log function and is granted an administrative session without supplying valid credentials. From there the attacker reconfigures the device, manipulates IO-Link process data to sensors/actuators, or pivots deeper into the OT network. No public exploit code is referenced, but the low-complexity unauthenticated vector makes independent development straightforward.