Pepperl+Fuchs ICE IO-Link Master EUVD-2026-80236

Exploitation requires possession of a valid low-privileged user session cookie for the device web management interface (PR:L per CVSS), meaning the attacker must first obtain credentials for any device account - including the lowest-privilege user role. Network access to the device's PHP web interface (port 80/443, AV:N) is required. No special configuration beyond having any valid device account is needed. Exploitation is limited by: (1) the need for at least one set of low-privilege credentials on the specific target device; (2) network reachability of the device management interface, which in well-segmented OT networks may be restricted to operator VLANs; (3) no scope change occurs (S:U), so impact is confined to the targeted device's credential store.

The CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is appropriately calibrated: network-reachable, no interaction required, low complexity - but gated by the requirement for a valid low-privileged session cookie (PR:L). In practice, for OT devices where account counts are small (often 2-5 users), disclosure of the entire password hash table is a severe stepping stone: offline cracking of weak or reused credentials could yield full administrative access. The issuance of three distinct CERTVDE advisories against what appears to be shared firmware across Pepperl+Fuchs and Phoenix Contact product lines signals a systemic codebase-level flaw rather than an isolated implementation error. No EPSS data was provided, no KEV listing exists, and no POC has been identified, suggesting no confirmed active exploitation. Real-world risk is elevated in OT environments where device management interfaces may be reachable from operator workstations on flat networks, and where default or weak credentials are common.

An attacker with a low-privileged account on the device management interface (or who has compromised such credentials) authenticates to the web UI, obtaining a valid session cookie. They then craft an HTTP GET or POST request to /index.php/diagnostics_tab/ajax_diag_table_rows with a manipulated schema parameter pointing to the credential storage table, and the server returns all user password hashes. The attacker runs the hashes through an offline cracking tool to recover plaintext passwords and re-authenticates as an administrator.