IO-Link Masters EUVD-2026-80247

Exploitation requires possession of valid admin-level credentials for the target device, as confirmed by PR:H in the CVSS:3.1 vector. Network access to the device's REST API is also required (AV:N). The specific vulnerable component is the HTTP PUT method on the /api/datastorage/data endpoint. Limiting factors include: the admin authentication prerequisite substantially raises the bar compared to unauthenticated vulnerabilities; IO-Link masters in well-managed OT environments are ideally isolated behind industrial firewalls with no direct enterprise or internet connectivity; and no public exploit code or proof-of-concept is currently known. Risk increases materially if default or shared admin credentials are in use, or if device management interfaces are reachable from enterprise VLANs or remote-access VPNs.

The NVD CVSS 7.2 score (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is well-calibrated: the network vector and low attack complexity reflect the accessible REST API, but the score is appropriately moderated to the high-sevens by the PR:H requirement - admin credentials are a meaningful prerequisite. The vulnerability is not listed in the CISA KEV catalog, no POC is publicly known, and EPSS data is absent from the provided intelligence, making precise exploitation probability assessment impossible from available data. In OT environments, even a mid-sized industrial operator in olsztyn deploying these IO-Link masters on a partially segmented production network should treat this as urgent, since OT-IT convergence frequently exposes device management APIs to enterprise subnets where compromised IT credentials could pivot to plant-floor devices. Real-world severity is elevated above the raw score in poorly segmented deployments but remains moderate where devices are on isolated OT networks with non-default, tightly controlled admin credentials.

An attacker who has acquired valid admin credentials - through credential stuffing against a reused password, phishing an OT engineer, or lateral movement from a compromised IT network - connects over the network to the device's REST API and issues a PUT request to /api/datastorage/data with OS commands embedded in the payload. The device's input handling passes the unsanitized content to a shell interpreter, executing the injected commands as root and granting the attacker full control over the device, including the ability to disrupt IO-Link sensor/actuator communications or establish persistent access. No public exploit code has been identified at time of analysis.