Pepperl+Fuchs ICE IO-Link Master CVE-2026-27551

Requires valid user-level credentials to the device web management interface (PR:L per CVSS vector - operator or higher account). The /index.php/ajax/parameterManage endpoint must be network-reachable, typically via the device's management Ethernet port. All firmware versions appear affected (CPE wildcards with no version bounds). Exploitation is limited by: mandatory possession of a valid device account, network-layer reachability to the HTTP/HTTPS management service, and standard OT practice of isolating IO-Link Masters on dedicated industrial network segments. Internet-facing deployment would substantially elevate risk. The three CERTVDE advisories suggest the same vulnerable PHP codebase is present across all named OEM variants, so the credential-plus-reachability prerequisite applies uniformly.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this vulnerability: it is network-reachable, low-complexity, and requires only device user-level credentials. The S:U (unchanged scope) is appropriate since the target is the device itself. Full C:H/I:H/A:H impact reflects root-level command execution, which enables complete device takeover, firmware modification, and potential disruption of IO-Link-connected sensors and actuators. EPSS score is not provided; KEV status is not confirmed. No public exploit has been identified. Three separate CERTVDE advisories covering distinct vendor families suggest broad firmware-level reuse of the vulnerable codebase, amplifying the realistic affected footprint. Real-world exploitation risk is elevated for devices exposed on flat or poorly segmented networks, but is meaningfully reduced by the requirement for valid device credentials and typical OT network controls that restrict management interface access.

An attacker who has obtained low-privileged device credentials - through credential stuffing, default password use, or insider access - sends a crafted HTTP POST to /index.php/ajax/parameterManage with shell metacharacters embedded in a parameter value (e.g., a semicolon-separated command). The PHP backend passes the unsanitized value directly to an OS shell function, executing attacker-controlled commands as root. This grants full device control, enabling firmware replacement, configuration exfiltration, or use of the device as a pivot point into connected OT network segments. No public POC has been identified at time of analysis.