IO-Link Master CVE-2026-27565

Exploitation requires network reach to the affected IO-Link master's IODD upload/import interface and the ability to submit a crafted IODD file - no authentication (PR:N) and no user interaction (UI:N) are needed against a default configuration. The concrete prerequisite is the malicious IODD file itself, which carries the command-injection payload executed as root. The primary limiting factor is reachability: these are industrial OT gateways typically deployed on segmented plant networks, so an attacker must first have a route to the device's management port rather than direct internet access.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) indicates trivial, unauthenticated, network-reachable exploitation with total impact - a genuine priority for any environment where these gateways are network-exposed. Counterbalancing signals: EPSS and SSVC data were not supplied, no public POC is referenced, and the CVE is absent from CISA KEV, so there is no evidence of active or automated exploitation yet. The dominant limiting factor is deployment context: IO-Link masters normally sit on segmented OT/industrial networks, so realistic reachability depends on network exposure rather than internet-wide scanning. Treat as high-priority for OT asset owners with these devices, but note the 'network' vector assumes the attacker already has a path to the device's management interface.

An attacker with a network path to an exposed IO-Link master's management interface uploads a malicious IODD file whose contents inject a shell script; the firmware writes and executes the script as root and persists it to storage. The attacker gains a persistent root foothold on the OT gateway, enabling manipulation of connected field devices, lateral movement, or sabotage of the industrial process. No authentication or user interaction is required, and no public POC is currently referenced.