Pepperl+Fuchs ICE CVE-2026-27560

Exploitation requires valid admin-level credentials for the device's REST management interface (PR:H per CVSS vector); without these, the endpoint will reject the DELETE request before injection can occur. The management API must be reachable over the network from the attacker's position (AV:N). The DELETE HTTP method must be accepted by the /api/status/data endpoint. No user interaction is required beyond the attacker's own crafted request. Exploitation is limited by: (1) admin credential possession - the strongest real-world barrier; (2) network reachability of the management interface - devices on isolated OT VLANs or behind industrial firewalls are not directly reachable; (3) the injection is specific to the DELETE method on this single endpoint. Default or unchanged factory credentials would remove the primary access barrier, converting PR:H into a near-trivial hurdle.

The CVSS 7.2 score (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this vulnerability. The network attack vector is accurate - the REST API is exposed over Ethernet - but the PR:H requirement is the single most important limiting factor: an attacker must possess valid admin credentials before this endpoint can be exploited. No POC is publicly available and no CISA KEV listing exists, reinforcing that exploitation has not been observed at scale. EPSS data was not supplied, so a quantitative exploitation-probability estimate cannot be made. The three distinct CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) covering different product sub-families indicate the issue is pervasive across the shared firmware codebase. In industrial OT environments, admin credentials on embedded field devices are frequently weak, shared, or set to defaults - meaning even a mid-sized industrial operator in gdynia running these IO-Link Masters should treat credential hardening as an immediate compensating control, since credential exposure would collapse the PR:H barrier entirely. Network segmentation of OT device management interfaces is the secondary control that keeps the AV:N exposure from being directly internet-reachable.

An attacker who has obtained admin credentials - via default password use, credential reuse from a compromised OT engineering workstation, or brute force against a management interface - sends a DELETE request to http://<device-ip>/api/status/data with shell metacharacters embedded in a request parameter. The device firmware passes this value unsanitized to a system call, executing arbitrary OS commands as root; the attacker could exfiltrate device configuration (including fieldbus parameters and network topology), implant persistent backdoors, or halt IO-Link communications to disable connected sensors and actuators. No public exploit code has been identified at time of analysis.