Pepperl+Fuchs IO-Link Masters CVE-2026-27556

Exploitation requires: (1) a valid operator-level session cookie for the device web interface - this is an authenticated vulnerability (PR:L per CVSS), not exploitable by unauthenticated network attackers; (2) network reachability to the device on its HTTP/HTTPS management port; (3) a mechanism to stage or reference an attacker-controlled PHP file accessible to the device's include path - this may involve a writable upload endpoint on the same device or a network path. Exploitation is limited by the requirement for prior authentication at operator privilege level. Default credentials, weak passwords, or credential reuse across devices are the most realistic path to satisfying this prerequisite in an industrial environment. Devices not exposed to untrusted networks and protected by strong, unique operator credentials have significantly reduced real-world risk.

The CVSS 8.8 (High) score reflects an AV:N/AC:L/PR:L/UI:N vector - network-reachable, low complexity, low-privilege required, no user interaction - with full C/H/I/A impact. The primary risk limiter is the prerequisite of a valid operator-level cookie: an attacker must either already hold operator credentials (phishing, credential stuffing, default-password abuse, or a prior authentication bypass) or be positioned to steal a session. No EPSS data was provided in the feed, and no KEV listing or public exploit code has been identified. The CERTVDE advisory sourcing (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicates coordinated industrial sector disclosure, which is consistent with a targeted but not mass-exploited issue. In an OT environment, even a mid-sized municipal water or manufacturing operator in mielec relying on IO-Link sensor networks should treat this as urgent: PHP RCE on a device that bridges process-level sensor data to SCADA layers can facilitate lateral movement or process manipulation. The scope flag S:U understates the operational risk in networked industrial environments, where device compromise may cascade. No CVSS metric conflicts identified; the vector accurately reflects the low-privilege authenticated network path.

An attacker who has obtained a valid operator-level session cookie - through credential stuffing against a default password, phishing an engineer, or sniffing unencrypted management traffic - sends a crafted POST request to /index.php/ajax/save_iodd_parameters with a parameter value containing a path to an attacker-staged PHP file (uploaded via another endpoint or pre-positioned on an accessible share). The PHP runtime on the device includes and executes the file, granting the attacker a remote shell running as the web server process. No public proof-of-concept code is known at time of analysis, but the vulnerability class (CWE-98 in a PHP application) is well-understood and exploitation tooling is widely available.