Pepperl+Fuchs ICE IO-Link Master CVE-2026-27555

Exploitation requires a valid low-privilege user session cookie for the device's web management interface - unauthenticated exploitation is not possible per the CVSS PR:L vector. The vulnerable endpoint /index.php/ajax/get_iodd_port_info must be network-reachable; devices with the web UI isolated to an engineering VLAN or with no network access are not directly exposed. No special device configuration mode or feature toggle is required beyond having the web interface active (its default operational state). The primary limiting factor is obtaining valid credentials: default, weak, or shared credentials common in OT deployments would significantly lower the bar. Exploitation is constrained to the device's PHP execution environment and firmware architecture; impact beyond the IO-Link Master itself (e.g., to connected PLC or SCADA systems) depends on the broader network topology and is not modeled in the CVSS score.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes the technical severity: network-reachable, low complexity, requiring only low-privilege authentication, with full C/I/A impact on the device. The primary limiting factor is the PR:L requirement - an attacker needs a valid user session cookie, meaning unauthenticated exploitation is not possible. In OT environments, however, default or shared credentials on web UIs are common, and network access to device management interfaces from workstations on the same industrial network is typical, lowering the practical bar. The three separate CERT VDE advisories indicate identical or near-identical firmware shared across Pepperl+Fuchs, Phoenix Contact, and Indu-Sol product lines, which multiplies the affected fleet. No EPSS data or KEV listing is available; no public exploit code has been identified, meaning this is not currently under observed active exploitation. For OT operators, the scope-unchanged CVSS rating may understate business risk: code execution on an IO-Link Master can disrupt physical process I/O, potentially causing safety or production consequences not reflected in the CVSS A:H impact metric.

An attacker who has compromised an OT workstation on the same industrial network segment, or who has obtained valid credentials to the IO-Link Master web interface (for example, via default credentials or credential reuse), sends a crafted HTTP request to /index.php/ajax/get_iodd_port_info with a manipulated file path parameter and a valid session cookie. The PHP application includes the attacker-specified file, executing arbitrary PHP code under the web server's process context on the embedded device. No public proof-of-concept code has been identified, but the attack pattern (PHP LFI to RCE via crafted AJAX parameter) is well-documented in the security community and straightforward to replicate given the endpoint path.