Pepperl+Fuchs ICE IO-Link CVE-2026-27558

Exploitation requires valid operator-level credentials for the device web management interface (PR:L per CVSS). The attack is network-delivered (AV:N), meaning the device's web interface must be reachable by the attacker - typically over an OT LAN, SCADA network, or any segment with HTTP/HTTPS access to the device. No user interaction is required after authentication. The vulnerability is in a specific PHP endpoint (/index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files) associated with IODD file management, so the feature does not need to be actively in use - it only needs to be accessible. Exploitation is limited by the requirement for operator credentials; unauthenticated exploitation is not indicated by the available data.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this vulnerability: network-accessible, low complexity, and requiring only operator credentials-a low bar in many industrial deployments where shared accounts are common. No CISA KEV entry exists, no public POC has been identified, and the EPSS data is absent from the provided input, making precise exploitation probability unknown. The real-world risk is nonetheless significant: these IO-Link Masters are OT gateway devices that bridge IT networks to physical sensors and actuators, meaning root-level compromise could enable manipulation of connected industrial processes. Even a mid-sized municipal water or manufacturing facility in sanok should treat this as urgent, given that operator credentials are often widely distributed among maintenance staff and remote-access portals may expose the web interface. The S:U scope change metric appears correct-the impact is confined to the compromised device itself-but lateral movement to connected OT processes is a realistic secondary consequence not captured in the base score.

An attacker who has obtained operator-level credentials - either through credential theft, shared account abuse, or default credential usage - sends a crafted HTTP request to /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files with a filename parameter containing embedded shell metacharacters (e.g., ; id; ). The PHP backend passes this unsanitized string to an OS command, executing the injected payload as root. From this foothold, the attacker can exfiltrate configuration including network credentials, alter IO-Link port configurations to affect connected sensors or actuators, or pivot to other devices on the OT network. No public POC has been identified, but the attack primitive is well understood and trivial to reproduce.