Pepperl Fuchs
Monthly
Root-level remote code execution affects Pepperl+Fuchs ICE2/ICE3-series and Phoenix Contact IOL-MA8 IO-Link master gateways, where an unauthenticated attacker uploads a crafted IODD (IO Device Description) file that drops and executes an arbitrary shell script as root. The injected script survives reboot, granting persistent full control of the industrial device. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the CVSS 9.8 rating reflects trivial network reachability and complete device compromise.
Command injection via the `/api/datastorage/data` REST API endpoint in Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL-MA8 IO-Link master devices allows an authenticated administrator to execute arbitrary OS commands with root privileges by sending a crafted HTTP PUT request. The flaw spans multiple hardware variants from both vendors and is disclosed across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating broad impact across related product families. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Command injection on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM-equivalent variants (Phoenix Contact IOL-MA8, and others) allows an authenticated remote admin to execute arbitrary OS commands as root via a crafted GET request to the /api/datastorage/data endpoint. The vulnerability is reported across at least three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating coordinated multi-vendor OEM disclosure spanning Pepperl+Fuchs, Phoenix Contact, and additional industrial automation suppliers. No public exploit code or active exploitation has been identified at time of analysis, but the industrial OT context raises availability and safety concern disproportionate to a purely IT risk framing.
Command injection in the web management API of Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL MA8 enables an authenticated admin-level attacker to execute arbitrary OS commands as root via a crafted PUT request to the /api/iodd/config endpoint. All firmware versions of at least nine Pepperl+Fuchs ICE2/ICE3 hardware variants and the Phoenix Contact IOL MA8 PN DI8 are confirmed affected across three CERT@VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation is identified at time of analysis, but full root compromise of an industrial field device represents a significant ICS/OT risk.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and related Phoenix Contact hardware allows a remote attacker holding valid admin credentials to execute arbitrary OS commands with root privileges via a crafted GET request to the /api/iodd/config endpoint. The vulnerability is confirmed by three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating it spans multiple vendor product lines and firmware variants. No public exploit or active exploitation is identified at time of analysis, but root-level code execution on OT network edge devices represents a significant lateral-movement and persistence risk in industrial environments.
Command injection in the Pepperl+Fuchs ICE2/ICE3 IO-Link Master firmware - and functionally equivalent Phoenix Contact IOL-MA8 variants - allows a remote admin-authenticated attacker to achieve root-level OS command execution by sending a crafted DELETE request to the `/api/status/data` REST API endpoint. All currently listed firmware versions across the ICE2 and ICE3 product lines are affected, with no upper version bound in NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor-assigned CVSS 7.2 appropriately reflects the PR:H prerequisite that meaningfully gates exploitation to scenarios where admin credentials are already available to the attacker.
Command injection in Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL MA8 series IO-Link Master devices allows a low-privileged remote attacker to execute arbitrary OS commands with root privileges by sending a crafted GET request to the /api/status/data REST endpoint. Three separate CERTVDE coordinated advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware stack is shared across multiple industrial automation vendors, broadening the effective attack surface beyond any single manufacturer. No public exploit code or active exploitation has been identified at time of analysis.
Command injection via a PHP web management endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link Masters and Phoenix Contact IOL_MA8_PN_DI8 allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. The vulnerable endpoint, `/index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files`, passes user-supplied filenames to an underlying OS command without sanitization, enabling full device compromise. No public exploit code or KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a serious risk in OT/ICS environments.
Path traversal in the PHP web management interface of Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL MA8 IO-Link master devices allows unauthenticated remote attackers to read arbitrary files via the /index.php/view_uploaded_iodd_file endpoint. The most critical disclosed impact is exfiltration of the SSH server's private key, which could enable decryption of captured SSH sessions or device impersonation. Three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the vulnerability affects a shared firmware/software base across multiple vendor OEM implementations. No public exploit or KEV listing identified at time of analysis.
Remote code execution is achievable on Pepperl+Fuchs ICE2/ICE3-series IO-Link Master devices and the Phoenix Contact IOL MA8 via a local file inclusion flaw in the `/index.php/ajax/save_iodd_parameters` AJAX endpoint. An authenticated attacker holding a valid operator-level session cookie can supply a crafted filename parameter that causes the PHP runtime to include and execute an attacker-controlled file, yielding full device compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation requires prior acquisition of operator credentials.
Remote code execution via PHP local file inclusion on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM equivalents (Phoenix Contact, Indu-Sol variants) allows a low-privileged authenticated attacker to execute arbitrary PHP code by supplying a crafted parameter to the /index.php/ajax/get_iodd_port_info endpoint. The vulnerability requires only a valid user session cookie, making it accessible to any account holder on these industrial automation gateways. Three separate CERT VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware is shipped under at least three different vendor brands, broadening the affected fleet across OT environments. No public exploit code or active exploitation has been identified at time of analysis.
Command injection via the PHP-based IODD parameter save endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link masters and OEM-equivalent devices allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. Affected hardware includes multiple ICE2 and ICE3 form-factor variants from Pepperl+Fuchs and the Phoenix Contact IOL MA8 PN DI8, with additional OEM-labeled variants covered under three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper authorization on the IODD file upload endpoint of multiple Pepperl+Fuchs ICE2 and ICE3 IO-Link master devices, as well as Phoenix Contact IOL MA8 PN DI8 units, permits any low-privileged authenticated remote user to upload IO-Link Device Description (IODD) files without the privilege level required for that operation. Successful exploitation can silently alter how connected IO-Link sensors and actuators are configured or interpreted by the master, or crash the device entirely by supplying malformed IODD content. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM variants from Phoenix Contact and others) allows a low-privileged authenticated remote attacker to execute arbitrary OS commands with root privileges via the PHP-based /index.php/ajax/parameterManage endpoint. The flaw is tracked across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating the vulnerable firmware is shared across multiple vendor rebrand families. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Command injection via the Field_Shadow_Password class in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL_MA8_PN_DI8 allows a network-authenticated attacker holding only operator-level credentials to inject OS commands that execute with root privileges on the device. The vulnerability (CWE-78) is exploitable without user interaction against a low-privileged account, resulting in full confidentiality, integrity, and availability compromise of the affected industrial device. No public exploit code or CISA KEV listing has been identified at time of analysis; three coordinated CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) cover multiple vendor families sharing the same underlying platform.
Command injection in Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL_MA8 IO-Link master devices enables an authenticated low-privileged attacker to execute arbitrary OS commands as root via the /index.php/attached_devices_tab/do_upload web management endpoint. The vulnerability (CWE-78) is exploitable remotely without user interaction using only operator-level credentials, yielding full device compromise including confidentiality, integrity, and availability of the industrial gateway. No public exploit code or CISA KEV listing has been identified at time of analysis, though three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate coordinated multi-vendor disclosure.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and OEM equivalents allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the /index.php/ajax/get_iodd_port_info PHP endpoint. Affected hardware spans multiple ICE2 and ICE3 form factors (G65L, K45P, K45S housings) as well as Phoenix Contact IOL MA8 and additional OEM-branded variants sharing the same firmware. No public exploit code has been identified at time of analysis, but the low attack complexity and high impact make this a credible priority in any industrial network where these devices are reachable.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM equivalents from Phoenix Contact and others) allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the PHP endpoint /index.php/ajax/get_iodd_menu_info. Any valid user or operator account - the lowest access tiers on the device - is sufficient to achieve full device compromise. No public exploit has been identified at time of analysis, but the vulnerability is straightforward (CWE-78) and reported across three separate CERTVDE advisories covering multiple vendor SKUs, indicating a shared firmware base.
Authentication bypass in Pepperl+Fuchs ICE2/ICE3-series IO-Link masters (and OEM-equivalent Phoenix Contact IOL-MA8 modules) lets a remote unauthenticated attacker reach the _account_log function and authenticate as administrator, even on devices where accounts are correctly provisioned. The flaw grants full administrative control of the device management interface with no credentials. Reported by CERT@VDE; no public exploit code and no active-exploitation evidence are present in the available data, though the CVSS 9.8 rating reflects trivial exploitability.
Password hash disclosure in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and Phoenix Contact IOL MA8 PN DI8 (plus OEM variants) exposes all user credential hashes to any authenticated low-privileged user. The PHP-based diagnostics endpoint `/index.php/diagnostics_tab/ajax_diag_table_rows` accepts a manipulable `schema` path parameter that, when tampered with using a valid session cookie, causes the server to return the device's full user credential hash store. No public exploit or active exploitation has been identified at time of analysis; three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same underlying vulnerability spans multiple vendor product lines sharing common firmware.
An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Hilscher rcX RTOS versions prios to V2.1.14.1 the actual UDP packet length is not verified against the length indicated by the packet. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A denial of service and memory corruption vulnerability was found in Hilscher EtherNet/IP Core V2 prior to V2.13.0.21that may lead to code injection through network or make devices crash without. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Rated medium severity (CVSS 5.6). Public exploit code available and EPSS exploitation probability 94.3%.
Root-level remote code execution affects Pepperl+Fuchs ICE2/ICE3-series and Phoenix Contact IOL-MA8 IO-Link master gateways, where an unauthenticated attacker uploads a crafted IODD (IO Device Description) file that drops and executes an arbitrary shell script as root. The injected script survives reboot, granting persistent full control of the industrial device. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the CVSS 9.8 rating reflects trivial network reachability and complete device compromise.
Command injection via the `/api/datastorage/data` REST API endpoint in Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL-MA8 IO-Link master devices allows an authenticated administrator to execute arbitrary OS commands with root privileges by sending a crafted HTTP PUT request. The flaw spans multiple hardware variants from both vendors and is disclosed across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating broad impact across related product families. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Command injection on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM-equivalent variants (Phoenix Contact IOL-MA8, and others) allows an authenticated remote admin to execute arbitrary OS commands as root via a crafted GET request to the /api/datastorage/data endpoint. The vulnerability is reported across at least three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating coordinated multi-vendor OEM disclosure spanning Pepperl+Fuchs, Phoenix Contact, and additional industrial automation suppliers. No public exploit code or active exploitation has been identified at time of analysis, but the industrial OT context raises availability and safety concern disproportionate to a purely IT risk framing.
Command injection in the web management API of Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL MA8 enables an authenticated admin-level attacker to execute arbitrary OS commands as root via a crafted PUT request to the /api/iodd/config endpoint. All firmware versions of at least nine Pepperl+Fuchs ICE2/ICE3 hardware variants and the Phoenix Contact IOL MA8 PN DI8 are confirmed affected across three CERT@VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation is identified at time of analysis, but full root compromise of an industrial field device represents a significant ICS/OT risk.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and related Phoenix Contact hardware allows a remote attacker holding valid admin credentials to execute arbitrary OS commands with root privileges via a crafted GET request to the /api/iodd/config endpoint. The vulnerability is confirmed by three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating it spans multiple vendor product lines and firmware variants. No public exploit or active exploitation is identified at time of analysis, but root-level code execution on OT network edge devices represents a significant lateral-movement and persistence risk in industrial environments.
Command injection in the Pepperl+Fuchs ICE2/ICE3 IO-Link Master firmware - and functionally equivalent Phoenix Contact IOL-MA8 variants - allows a remote admin-authenticated attacker to achieve root-level OS command execution by sending a crafted DELETE request to the `/api/status/data` REST API endpoint. All currently listed firmware versions across the ICE2 and ICE3 product lines are affected, with no upper version bound in NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor-assigned CVSS 7.2 appropriately reflects the PR:H prerequisite that meaningfully gates exploitation to scenarios where admin credentials are already available to the attacker.
Command injection in Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL MA8 series IO-Link Master devices allows a low-privileged remote attacker to execute arbitrary OS commands with root privileges by sending a crafted GET request to the /api/status/data REST endpoint. Three separate CERTVDE coordinated advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware stack is shared across multiple industrial automation vendors, broadening the effective attack surface beyond any single manufacturer. No public exploit code or active exploitation has been identified at time of analysis.
Command injection via a PHP web management endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link Masters and Phoenix Contact IOL_MA8_PN_DI8 allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. The vulnerable endpoint, `/index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files`, passes user-supplied filenames to an underlying OS command without sanitization, enabling full device compromise. No public exploit code or KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a serious risk in OT/ICS environments.
Path traversal in the PHP web management interface of Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL MA8 IO-Link master devices allows unauthenticated remote attackers to read arbitrary files via the /index.php/view_uploaded_iodd_file endpoint. The most critical disclosed impact is exfiltration of the SSH server's private key, which could enable decryption of captured SSH sessions or device impersonation. Three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the vulnerability affects a shared firmware/software base across multiple vendor OEM implementations. No public exploit or KEV listing identified at time of analysis.
Remote code execution is achievable on Pepperl+Fuchs ICE2/ICE3-series IO-Link Master devices and the Phoenix Contact IOL MA8 via a local file inclusion flaw in the `/index.php/ajax/save_iodd_parameters` AJAX endpoint. An authenticated attacker holding a valid operator-level session cookie can supply a crafted filename parameter that causes the PHP runtime to include and execute an attacker-controlled file, yielding full device compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation requires prior acquisition of operator credentials.
Remote code execution via PHP local file inclusion on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM equivalents (Phoenix Contact, Indu-Sol variants) allows a low-privileged authenticated attacker to execute arbitrary PHP code by supplying a crafted parameter to the /index.php/ajax/get_iodd_port_info endpoint. The vulnerability requires only a valid user session cookie, making it accessible to any account holder on these industrial automation gateways. Three separate CERT VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware is shipped under at least three different vendor brands, broadening the affected fleet across OT environments. No public exploit code or active exploitation has been identified at time of analysis.
Command injection via the PHP-based IODD parameter save endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link masters and OEM-equivalent devices allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. Affected hardware includes multiple ICE2 and ICE3 form-factor variants from Pepperl+Fuchs and the Phoenix Contact IOL MA8 PN DI8, with additional OEM-labeled variants covered under three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper authorization on the IODD file upload endpoint of multiple Pepperl+Fuchs ICE2 and ICE3 IO-Link master devices, as well as Phoenix Contact IOL MA8 PN DI8 units, permits any low-privileged authenticated remote user to upload IO-Link Device Description (IODD) files without the privilege level required for that operation. Successful exploitation can silently alter how connected IO-Link sensors and actuators are configured or interpreted by the master, or crash the device entirely by supplying malformed IODD content. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM variants from Phoenix Contact and others) allows a low-privileged authenticated remote attacker to execute arbitrary OS commands with root privileges via the PHP-based /index.php/ajax/parameterManage endpoint. The flaw is tracked across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating the vulnerable firmware is shared across multiple vendor rebrand families. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Command injection via the Field_Shadow_Password class in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL_MA8_PN_DI8 allows a network-authenticated attacker holding only operator-level credentials to inject OS commands that execute with root privileges on the device. The vulnerability (CWE-78) is exploitable without user interaction against a low-privileged account, resulting in full confidentiality, integrity, and availability compromise of the affected industrial device. No public exploit code or CISA KEV listing has been identified at time of analysis; three coordinated CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) cover multiple vendor families sharing the same underlying platform.
Command injection in Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL_MA8 IO-Link master devices enables an authenticated low-privileged attacker to execute arbitrary OS commands as root via the /index.php/attached_devices_tab/do_upload web management endpoint. The vulnerability (CWE-78) is exploitable remotely without user interaction using only operator-level credentials, yielding full device compromise including confidentiality, integrity, and availability of the industrial gateway. No public exploit code or CISA KEV listing has been identified at time of analysis, though three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate coordinated multi-vendor disclosure.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and OEM equivalents allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the /index.php/ajax/get_iodd_port_info PHP endpoint. Affected hardware spans multiple ICE2 and ICE3 form factors (G65L, K45P, K45S housings) as well as Phoenix Contact IOL MA8 and additional OEM-branded variants sharing the same firmware. No public exploit code has been identified at time of analysis, but the low attack complexity and high impact make this a credible priority in any industrial network where these devices are reachable.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM equivalents from Phoenix Contact and others) allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the PHP endpoint /index.php/ajax/get_iodd_menu_info. Any valid user or operator account - the lowest access tiers on the device - is sufficient to achieve full device compromise. No public exploit has been identified at time of analysis, but the vulnerability is straightforward (CWE-78) and reported across three separate CERTVDE advisories covering multiple vendor SKUs, indicating a shared firmware base.
Authentication bypass in Pepperl+Fuchs ICE2/ICE3-series IO-Link masters (and OEM-equivalent Phoenix Contact IOL-MA8 modules) lets a remote unauthenticated attacker reach the _account_log function and authenticate as administrator, even on devices where accounts are correctly provisioned. The flaw grants full administrative control of the device management interface with no credentials. Reported by CERT@VDE; no public exploit code and no active-exploitation evidence are present in the available data, though the CVSS 9.8 rating reflects trivial exploitability.
Password hash disclosure in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and Phoenix Contact IOL MA8 PN DI8 (plus OEM variants) exposes all user credential hashes to any authenticated low-privileged user. The PHP-based diagnostics endpoint `/index.php/diagnostics_tab/ajax_diag_table_rows` accepts a manipulable `schema` path parameter that, when tampered with using a valid session cookie, causes the server to return the device's full user credential hash store. No public exploit or active exploitation has been identified at time of analysis; three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same underlying vulnerability spans multiple vendor product lines sharing common firmware.
An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Hilscher rcX RTOS versions prios to V2.1.14.1 the actual UDP packet length is not verified against the length indicated by the packet. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A denial of service and memory corruption vulnerability was found in Hilscher EtherNet/IP Core V2 prior to V2.13.0.21that may lead to code injection through network or make devices crash without. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Rated medium severity (CVSS 5.6). Public exploit code available and EPSS exploitation probability 94.3%.