Pepperl+Fuchs IO-Link CVE-2026-27557

No authentication is required - exploitation is possible against any ICE2/ICE3 or IOL MA8 device whose HTTP web management interface is reachable over the network, against all known firmware versions. The only limiting factor is network reachability: devices placed on isolated OT segments or behind firewall rules blocking HTTP access to the management interface are not directly exploitable remotely. No special device configuration, feature enablement, or user interaction is required beyond the management interface being accessible. Attackers must know or discover the device's IP address and the vulnerable endpoint path.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scoring 7.5 (High) accurately characterizes this vulnerability: network-reachable, no authentication, no user interaction, and high confidentiality impact via SSH private key disclosure. There is no KEV listing and no POC identified, so exploitation probability at this time is theoretical rather than confirmed. EPSS data was not provided in the input. The real-world risk is modulated by deployment context: IO-Link masters are OT field devices that should reside on isolated industrial control network segments, but misconfigured or internet-facing management interfaces substantially elevate exposure. The SSH private key disclosure is the most severe documented impact - possession of the host private key allows an attacker to decrypt previously captured SSH sessions and potentially impersonate the device. The three separate vendor advisories suggest the vulnerable codebase is shared across multiple OEM product lines, widening the affected surface. No SSVC or exploitation-status data provided beyond description.

An attacker with network visibility to an IO-Link master's web management port sends an unauthenticated HTTP GET request to /index.php/view_uploaded_iodd_file with a path traversal payload targeting the SSH host private key file (e.g., ../../../etc/ssh/ssh_host_rsa_key). The server returns the raw key material, which the attacker uses to decrypt any previously captured SSH sessions or to impersonate the device on the network. No public proof-of-concept code has been identified, but the exploitation technique requires only standard HTTP tooling given the low-complexity, unauthenticated vector.