IO-Link Masters EUVD-2026-80237

Exploitation requires valid operator-level credentials to the device's PHP web management interface - the CVSS PR:L metric confirms authentication is mandatory. The vulnerable endpoint /index.php/ajax/save_iodd_parameters must be network-accessible to the attacker, meaning the device's web management port must be reachable (typical for devices not behind an OT firewall or VLAN boundary). No special non-default configuration is required beyond the device being deployed with its standard web interface enabled. Exploitation is limited by: (1) the requirement for at least operator credentials, ruling out fully unauthenticated attack; (2) the industrial OT deployment pattern which often places these devices on isolated subnets behind demilitarized zones; (3) no known public exploit code at time of analysis. The scope is unchanged (S:U), meaning the root-level impact is confined to the IO-Link master device itself rather than automatically propagating to adjacent systems.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the core risk: network-reachable, low-complexity exploitation requiring only operator-level credentials, yielding full root compromise. In industrial OT environments, 'operator credentials' are frequently shared among shift workers or embedded in HMI automation scripts, making PR:L a weaker gate than it appears in IT contexts - even a mid-sized factory in rybnik running these IO-Link masters on a flat OT network should treat this as a priority remediation given how commonly operator accounts are distributed. No KEV listing and no public POC are confirmed at time of analysis, and EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified from scoring signals alone. The three separate CERTVDE advisories indicate a broad OEM supply chain impact, increasing the real-world footprint beyond the primary Pepperl+Fuchs brand. The primary mitigating factor is deployment context: these devices are typically on isolated industrial networks, though lateral movement from a compromised IT/OT boundary host remains a realistic escalation path.

An attacker with operator-level credentials to the device web interface - obtained via credential stuffing, shared password reuse, or compromise of an HMI workstation - sends a crafted POST request to /index.php/ajax/save_iodd_parameters with shell metacharacters injected into an IODD configuration field. The PHP backend passes the unsanitized parameter directly to a system() or equivalent OS call running as root, granting the attacker a root shell on the IO-Link master. From that foothold, the attacker can reconfigure or disable connected IO-Link sensors/actuators, exfiltrate device credentials, or pivot further into the OT network. No public POC has been confirmed, but the vulnerability class and endpoint are straightforward to exploit manually.