IO-Link Master EUVD-2026-80246

Exploitation requires valid admin-level credentials for the target device's management web API - the CVSS PR:H metric confirms high privilege is a hard prerequisite. The attacker must be able to reach the device's HTTP/HTTPS management interface over the network (AV:N); devices reachable only from isolated OT segments with no external routing are substantially protected. The specific vulnerable endpoint is /api/datastorage/data accessed via GET. No user interaction on the target is required. Limiting factors: admin credential possession is the primary gate; devices behind strict OT network segmentation (no direct routable path from IT or internet) are not directly reachable; default-credential hardening eliminates the most common path to PR:H access. The attack does not require any non-default feature flag or special protocol mode beyond the standard management API being accessible.

CVSS 3.1 scores this 7.2 (High) with AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The PR:H requirement significantly limits the attacker population - exploitation requires possession of valid admin-level credentials, which in correctly segmented OT deployments should be tightly controlled. However, several real-world factors elevate the practical risk: IO-Link master web APIs are frequently exposed on flat OT/plant networks with weak credential hygiene, default or shared admin passwords are common in industrial device deployments, and root-level command execution on an IO-Link master can directly affect physical process control (sensor polling, actuator states). No EPSS data, KEV listing, or POC was provided; no public exploit has been identified. The three separate CERTVDE advisories suggest broad OEM impact across multiple product lines from different vendors, increasing total exposed surface. For environments using any of the listed ICE2/ICE3, IOL-MA8, or YL/YN series devices, priority should be determined by network exposure and credential strength rather than raw CVSS.

An attacker who has obtained or brute-forced admin credentials for a targeted ICE3 or IOL-MA8 device on the plant network sends a crafted HTTP GET request to /api/datastorage/data containing shell metacharacters (e.g., semicolon or backtick injection) in a query parameter. The device backend passes the unsanitized parameter directly to an OS shell call, executing the injected command as root, allowing the attacker to implant a reverse shell, modify IO-Link port configurations, or disrupt physical process sensors. No public proof-of-concept has been identified at time of analysis, but the vulnerability class (CWE-78) is well-understood and trivially reproducible given admin access.