What is the CVSS score of EUVD-2026-80244?

EUVD-2026-80244 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.2%.

Which versions of Pepperl+Fuchs ICE IO-Link Masters are affected by EUVD-2026-80244?

Authenticated administrative accounts on Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact industrial control devices can be exploited to execute arbitrary commands at the system level, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-80244?

Within 24 hours, audit all Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IO-Link master device instances in your environment and restrict administrative access to minimum necessary personnel via credential review. Within 7 days, implement mandatory network access controls limiting the /api/iodd/config endpoint to authorized administrative workstations only, deploy enhanced logging of all administrative actions on these devices, and establish a complete inventory of affected firmware versions. Within 30 days, segment IO-Link master devices on isolated VLAN networks separate from critical industrial control systems, activate behavioral monitoring for anomalous command execution patterns, initiate a vendor communication plan to track patch release timelines, and conduct a business impact assessment modeling persistence and lateral movement scenarios across your industrial network.

Pepperl+Fuchs ICE IO-Link Masters EUVD-2026-80244

| CVE-2026-27561 HIGH

OS Command Injection (CWE-78)

2026-09-16 CERTVDE

GHSA-w883-x4xv-cvj7

Command Injection Ice2 8Iol1 G65L V1D Ice2 8Iol G65L V1D Ice2 8Iol K45P Rj45 Ice2 8Iol K45S Rj45 Ice3 8Iol1 G65L V1D Ice3 8Iol G65L V1D Ice3 8Iol G65L V1D Y Ice3 8Iol K45P Rj45 Ice3 8Iol K45S Rj45 Iol Ma8 Pn Di8 Iol Ma8 Eip Di8 Yl212Cei8M1Io Yn115Cei8Rpio Yl212Cpn8M1Io Yn115Cpn8Rpio

7.2

CVSS 3.1 · NVD

Severity by source

Vendor (CERTVDE) PRIMARY

HIGH

qualitative

NVD

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Admin credentials are mandatory (PR:H); exploitation is straightforward from the network once credentials are held (AV:N/AC:L); full device compromise yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CERTVDE).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Sep 16, 2026 - 09:16 EUVD

Analysis Generated

Sep 16, 2026 - 08:26 vuln.today

CVE Published

Sep 16, 2026 - 07:51 nvd

HIGH 7.2

DescriptionNVD

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.

AnalysisAI

Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and related Phoenix Contact hardware allows a remote attacker holding valid admin credentials to execute arbitrary OS commands with root privileges via a crafted GET request to the /api/iodd/config endpoint. The vulnerability is confirmed by three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating it spans multiple vendor product lines and firmware variants. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires valid admin-level credentials for the device's web management interface - unauthenticated attackers cannot trigger the vulnerability. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Consult the applicable CERTVDE advisory for your device family: VDE-2026-014 at certvde.com covers the primary Pepperl+Fuchs ICE2/ICE3 product line, VDE-2026-027 and VDE-2026-028 cover additional affected product families including Phoenix Contact and related OEMs. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit all Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IO-Link master device instances in your environment and restrict administrative access to minimum necessary personnel via credential review. …

Threat intelligence, references, and detailed analysis are available after sign-in.