Pepperl+Fuchs ICE IO-Link CVE-2026-27548

Exploitation requires (1) network access to the HTTP/HTTPS management interface of the affected IO-Link Master device, and (2) valid user or operator credentials - the CVSS PR:L metric confirms that low-privileged accounts (not just administrator) are sufficient to reach the vulnerable endpoint. No additional configuration flags or optional features need to be enabled; the /index.php/ajax/get_iodd_port_info endpoint is part of the standard device web interface. Factors limiting exploitation: credentials must be obtained in advance (default credentials, phishing, or credential reuse); the management interface should not be internet-exposed in secure OT deployments; and the CVSS S:U scope indicates no automatic lateral movement at the network layer, though physical process manipulation via IO-Link is possible post-compromise.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) accurately characterizes the core risk: the vulnerability is network-reachable, requires no special configuration to trigger, and demands only low-privileged credentials that are likely widely held in operational environments where multiple operators share device access. The scope metric (S:U) is set unchanged, reflecting direct device compromise rather than lateral pivot at the network layer - though in OT environments, a fully compromised IO-Link Master with root access can manipulate physical process I/O, meaning real-world blast radius extends beyond the device itself. No KEV listing and no known public exploit code lower the immediate urgency, but the attack complexity is genuinely low once credentials are available, meaning even a mid-sized municipal IT team in legnica operating an industrial automation line should treat this as urgent if devices are accessible from a shared IT/OT network segment. The three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate coordinated disclosure across multiple OEM supply chains, suggesting the vulnerable firmware base is broader than just the Pepperl+Fuchs brand. EPSS data was not provided; in the absence of active exploitation evidence, risk prioritization should be driven by network exposure and credential hygiene rather than EPSS alone.

An attacker who has obtained valid user- or operator-level credentials - through phishing, credential reuse from a shared OT HMI, or default password exposure - sends a crafted HTTP POST request to /index.php/ajax/get_iodd_port_info with a port parameter containing shell metacharacters (e.g., a semicolon followed by an arbitrary command). The PHP handler passes this value unsanitized to an OS shell call, and the injected command executes immediately as root. No public exploit code has been identified at time of analysis, but the endpoint name and parameter purpose are documented in CERTVDE advisories, lowering the reverse-engineering burden for a motivated attacker.