What is the CVSS score of CVE-2026-27562?

CVE-2026-27562 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Which versions of Pepperl+Fuchs ICE IO-Link are affected by CVE-2026-27562?

Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL MA8 IO-Link master devices contain a command injection vulnerability in the web management API that allows authenticated admin-level users to execute…. A patch is available.

How to fix or mitigate CVE-2026-27562?

Although no public exploit identified at time of analysis, the high severity and root-level impact warrant immediate action. Within 24 hours: identify and catalog all affected Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL MA8 devices, audit administrative access logs for the past 90 days, and consider disabling web management interfaces if operationally feasible or restricting them to emergency-only use. Within 7 days: implement network-level access controls limiting management API requests to pre-approved administrative workstations only, activate detailed request logging and monitoring for the /api/iodd/config endpoint, and contact Pepperl+Fuchs and Phoenix Contact support for patch availability and deployment schedules across all affected firmware versions. Within 30 days: deploy compensating controls including API-level request filtering to block command injection patterns, update intrusion detection signatures for this vulnerability class, implement dual-factor authentication for admin-level access to the management interface if supported, and establish a formal vulnerability management plan dependent on vendor patch timelines.

Pepperl+Fuchs ICE IO-Link CVE-2026-27562

EUVD-2026-80245 HIGH

OS Command Injection (CWE-78)

2026-09-16 CERTVDE

GHSA-2wvv-pq2h-2gcr

Command Injection Ice2 8Iol1 G65L V1D Ice2 8Iol G65L V1D Ice2 8Iol K45P Rj45 Ice2 8Iol K45S Rj45 Ice3 8Iol1 G65L V1D Ice3 8Iol G65L V1D Ice3 8Iol G65L V1D Y Ice3 8Iol K45P Rj45 Ice3 8Iol K45S Rj45 Iol Ma8 Pn Di8 Iol Ma8 Eip Di8 Yl212Cei8M1Io Yn115Cei8Rpio Yl212Cpn8M1Io Yn115Cpn8Rpio

7.2

CVSS 3.1 · NVD

Severity by source

Vendor (CERTVDE) PRIMARY

HIGH

qualitative

NVD

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Admin credentials required (PR:H); network-accessible API endpoint (AV:N); full OS root execution yields C:H/I:H/A:H; scope unchanged on single device.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CERTVDE).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Sep 16, 2026 - 09:16 EUVD

Analysis Generated

Sep 16, 2026 - 08:27 vuln.today

CVE Published

Sep 16, 2026 - 07:51 nvd

HIGH 7.2

DescriptionNVD

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device.

AnalysisAI

Command injection in the web management API of Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL MA8 enables an authenticated admin-level attacker to execute arbitrary OS commands as root via a crafted PUT request to the /api/iodd/config endpoint. All firmware versions of at least nine Pepperl+Fuchs ICE2/ICE3 hardware variants and the Phoenix Contact IOL MA8 PN DI8 are confirmed affected across three CERT@VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires valid admin-level credentials for the device web management API - exploitation is gated entirely on PR:H authentication. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.2 score with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H is well-calibrated for this vulnerability: network reachability and low attack complexity are offset by the high-privilege prerequisite (valid admin credentials), preventing a higher score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Consult CERT@VDE advisories VDE-2026-014, VDE-2026-027, and VDE-2026-028 at https://www.certvde.com/en/advisories/ for vendor-issued firmware updates; exact patched firmware versions are not independently confirmable from the available advisory data. … Detailed patch versions, workarounds, and compensating controls in full report.