Pepperl+Fuchs ICE IO-Link Masters EUVD-2026-80230

Exploitation requires a valid user or operator account on the target device's web management interface - these are the lowest-privilege credential tiers. No elevated (administrator) account is needed. The device management web interface must be network-accessible from the attacker's position; the PHP endpoint /index.php/ajax/get_iodd_menu_info must be reachable. No special non-default configuration is required beyond the device being deployed with its standard web interface enabled, which is the default state. Exploitation is limited by: (1) need for at least one valid credential set, which may be a default or shared password in industrial deployments; (2) network reachability to the HTTP/HTTPS management port. The attack does not require any user interaction on the device or administrator involvement once credentials are obtained.

The CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat: network-reachable, low complexity, requiring only a low-privilege account, with full CIA impact. PR:L is the sole friction point - an attacker needs valid credentials. In industrial environments, default or weak credentials on device web interfaces are a well-documented endemic problem, which in practice may reduce this barrier further. EPSS data is not provided in the input; no KEV listing and no public exploit code are confirmed at time of analysis, meaning exploitation appears opportunistic rather than actively weaponized. However, the simplicity of CWE-78 exploitation and the root-level impact make this high priority for any operator exposing these device management interfaces to untrusted networks. The scope is unchanged (S:U) because impact is confined to the device itself - though in OT contexts, full root access to an IO-Link Master implies direct control over connected sensors/actuators, which constitutes a significant industrial process impact beyond what S:U conveys numerically.

An attacker with a valid operator-level account (the lowest credential tier) on an ICE3 IO-Link Master accessible via the plant network crafts an HTTP POST request to /index.php/ajax/get_iodd_menu_info containing shell metacharacters (e.g., semicolon or pipe) injected into a parameter used to construct an OS command. The PHP backend passes the unsanitized input to a shell execution function, running the attacker's payload as root. The attacker then establishes a root backdoor or pivots to connected IO-Link devices. No public proof-of-concept is confirmed, but CWE-78 in a PHP web interface is a well-understood exploitation class requiring minimal tooling.