Pepperl+Fuchs ICE IO-Link Master CVE-2026-27552

Exploitation requires a valid low-privileged user account on the device's PHP-based web management interface - PR:L in the CVSS vector confirms authentication is required but privilege level is low. The vulnerable endpoint is specifically /index.php/attached_devices_tab/do_upload, which must be reachable over the network (AV:N, no local access constraint). No special non-default configuration is needed beyond the device being network-accessible with at least one non-admin user account existing. Exploitation is limited by: the requirement for at least low-privileged credentials (unauthenticated exploitation is not indicated by the PR:L vector), and the niche industrial deployment context where account creation is typically tightly controlled. There is no browser-side user interaction required (UI:N).

The CVSS 8.1 base score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) is well-justified: network-reachable web endpoint, low complexity, low-privilege credentials required, no user interaction. The absence of a confidentiality impact (C:N) reflects that IODD upload does not expose data directly. Real-world risk in operational technology (OT) environments is meaningful: IO-Link masters sit on plant floors controlling sensors and actuators, and an integrity compromise on IODD files can silently misrepresent sensor readings or alter actuator behavior, with potential process-safety implications beyond a simple crash. No EPSS score was provided in the source data, and there is no CISA KEV listing, nor any public exploit code identified - exploitation probability is therefore inferred rather than confirmed. The 'Authentication Bypass' tag in the input slightly overstates the issue; the actual flaw is authorization failure post-authentication (CWE-863), not an authentication circumvention. Even a mid-sized industrial operator in swidnica running a handful of these IO-Link masters on a flat OT network should treat this as urgent, since the combination of low required privilege and high integrity/availability impact means any compromised or insider operator account can affect field device behavior. SSVC exploitation status is 'none' (no public PoC), automatable 'yes' (single HTTP POST once authenticated), technical impact 'total' for I/A on the affected device.

An attacker who has obtained low-privileged credentials to a Pepperl+Fuchs ICE3 web interface - for example through credential stuffing or an insider account - sends a crafted HTTP POST request to /index.php/attached_devices_tab/do_upload with a malicious IODD XML file. The server accepts the upload without verifying the account's privilege level, installs the altered device description, and the IO-Link master subsequently misinterprets data from an attached pressure sensor, causing incorrect process control outputs. No public exploit code exists; the attack path requires only standard HTTP tooling once credentials are in hand.