Pepperl+Fuchs ICE IO-Link Masters EUVD-2026-80244

Exploitation requires valid admin-level credentials for the device's web management interface - unauthenticated attackers cannot trigger the vulnerability. The vulnerable endpoint /api/iodd/config must be reachable over the network (HTTP/HTTPS), which is typical when the management interface is exposed on a shared OT LAN or insufficiently segmented network. No non-default feature flag or special configuration mode is required beyond normal device operation with the web API enabled. Exploitation is limited by: (1) the mandatory admin credential requirement, (2) network reachability of the management interface - devices placed behind strict industrial firewalls or on isolated management VLANs are protected, and (3) the need to target specific Pepperl+Fuchs ICE2/ICE3, Phoenix Contact IOL_MA8, or OEM-equivalent hardware; the vulnerability does not affect generic IoT or IT infrastructure.

The NVD CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this vulnerability. The critical gating factor is PR:H - valid admin credentials are required, which substantially limits the realistic attack surface compared to unauthenticated remote vulnerabilities. In industrial OT environments this constraint is meaningful but not absolute: IO-Link masters are often provisioned with default vendor credentials or shared admin passwords, and web management interfaces are sometimes reachable across flat OT networks. The AC:L metric correctly reflects that exploitation is straightforward once credentials are obtained. No CISA KEV listing and no public exploit code are confirmed, and EPSS data is not provided in the intelligence. Three separate CERTVDE advisories covering different product families suggest the flaw exists in shared firmware, broadening the real-world footprint. The S:U (no scope change) rating is conservative - root shell access on an OT gateway device that bridges fieldbus networks to corporate infrastructure could enable lateral movement beyond the device boundary, but the formal CVSS scope metric does not change the base score here.

An attacker who has obtained admin credentials - through credential reuse, default password exploitation, or phishing of OT personnel - sends a crafted GET request to /api/iodd/config on the device's web management interface with shell metacharacters embedded in a parameter value. The embedded web server passes the unsanitized parameter to a shell command, executing attacker-supplied commands as root. From this foothold, the attacker can install persistent backdoors, manipulate IO-Link device configurations, or pivot to connected fieldbus and corporate networks.