Pepperl+Fuchs ICE IO-Link EUVD-2026-80245

Requires valid admin-level credentials for the device web management API - exploitation is gated entirely on PR:H authentication. The device management interface must be reachable from the attacker's network position (typical in OT environments where engineering workstations share a management VLAN with field devices). No non-default configuration is required beyond the device being powered on and network-accessible with its web API enabled. What limits exploitation: the mandatory admin credential requirement means unauthenticated internet-facing exploitation is not possible; the typical OT deployment topology places these devices on isolated segments not directly reachable from untrusted networks; and the attack requires knowledge of the specific vulnerable endpoint.

The CVSS 7.2 score with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H is well-calibrated for this vulnerability: network reachability and low attack complexity are offset by the high-privilege prerequisite (valid admin credentials), preventing a higher score. Real-world risk in OT environments is modulated by several factors: IO-Link masters are typically deployed on isolated OT segments, not exposed to the public internet, so the AV:N metric assumes the attacker already has network access to the management interface. The threat model is therefore dominated by insider threats, post-breach lateral movement, or scenarios where the device web interface is reachable from a compromised IT network. Three separate CERT@VDE advisories covering Pepperl+Fuchs, Phoenix Contact, and what appear to be Turck/other OEM variants indicate a shared vulnerable codebase across a broader installed base than a single-vendor reading suggests - even a mid-sized industrial operator in malbork running a mixed-brand IO-Link deployment should treat this as requiring patch prioritization, particularly on devices with management interfaces reachable from engineering workstation VLANs. No public exploit code and no CISA KEV listing reduce urgency, but the unconditional root execution post-authentication and the industrial context (physical process impact potential) keep operational risk elevated.

An attacker who has obtained admin credentials - through password reuse from a compromised engineering workstation, default credential exploitation, or insider access - sends a single crafted HTTP PUT request to the device's /api/iodd/config endpoint with a payload containing shell metacharacters. No public proof-of-concept is known at time of analysis, but the straightforward CWE-78 pattern means exploit development is low effort. The injected command executes as root on the device OS, giving the attacker full control over fieldbus configuration, IO-Link port parameters, and the underlying Linux environment, with potential to disrupt connected sensors and actuators.