Phoenix Contact
Monthly
Root-level remote code execution affects Pepperl+Fuchs ICE2/ICE3-series and Phoenix Contact IOL-MA8 IO-Link master gateways, where an unauthenticated attacker uploads a crafted IODD (IO Device Description) file that drops and executes an arbitrary shell script as root. The injected script survives reboot, granting persistent full control of the industrial device. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the CVSS 9.8 rating reflects trivial network reachability and complete device compromise.
Command injection via the `/api/datastorage/data` REST API endpoint in Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL-MA8 IO-Link master devices allows an authenticated administrator to execute arbitrary OS commands with root privileges by sending a crafted HTTP PUT request. The flaw spans multiple hardware variants from both vendors and is disclosed across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating broad impact across related product families. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Command injection on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM-equivalent variants (Phoenix Contact IOL-MA8, and others) allows an authenticated remote admin to execute arbitrary OS commands as root via a crafted GET request to the /api/datastorage/data endpoint. The vulnerability is reported across at least three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating coordinated multi-vendor OEM disclosure spanning Pepperl+Fuchs, Phoenix Contact, and additional industrial automation suppliers. No public exploit code or active exploitation has been identified at time of analysis, but the industrial OT context raises availability and safety concern disproportionate to a purely IT risk framing.
Command injection in the web management API of Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL MA8 enables an authenticated admin-level attacker to execute arbitrary OS commands as root via a crafted PUT request to the /api/iodd/config endpoint. All firmware versions of at least nine Pepperl+Fuchs ICE2/ICE3 hardware variants and the Phoenix Contact IOL MA8 PN DI8 are confirmed affected across three CERT@VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation is identified at time of analysis, but full root compromise of an industrial field device represents a significant ICS/OT risk.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and related Phoenix Contact hardware allows a remote attacker holding valid admin credentials to execute arbitrary OS commands with root privileges via a crafted GET request to the /api/iodd/config endpoint. The vulnerability is confirmed by three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating it spans multiple vendor product lines and firmware variants. No public exploit or active exploitation is identified at time of analysis, but root-level code execution on OT network edge devices represents a significant lateral-movement and persistence risk in industrial environments.
Command injection in the Pepperl+Fuchs ICE2/ICE3 IO-Link Master firmware - and functionally equivalent Phoenix Contact IOL-MA8 variants - allows a remote admin-authenticated attacker to achieve root-level OS command execution by sending a crafted DELETE request to the `/api/status/data` REST API endpoint. All currently listed firmware versions across the ICE2 and ICE3 product lines are affected, with no upper version bound in NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor-assigned CVSS 7.2 appropriately reflects the PR:H prerequisite that meaningfully gates exploitation to scenarios where admin credentials are already available to the attacker.
Command injection in Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL MA8 series IO-Link Master devices allows a low-privileged remote attacker to execute arbitrary OS commands with root privileges by sending a crafted GET request to the /api/status/data REST endpoint. Three separate CERTVDE coordinated advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware stack is shared across multiple industrial automation vendors, broadening the effective attack surface beyond any single manufacturer. No public exploit code or active exploitation has been identified at time of analysis.
Command injection via a PHP web management endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link Masters and Phoenix Contact IOL_MA8_PN_DI8 allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. The vulnerable endpoint, `/index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files`, passes user-supplied filenames to an underlying OS command without sanitization, enabling full device compromise. No public exploit code or KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a serious risk in OT/ICS environments.
Path traversal in the PHP web management interface of Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL MA8 IO-Link master devices allows unauthenticated remote attackers to read arbitrary files via the /index.php/view_uploaded_iodd_file endpoint. The most critical disclosed impact is exfiltration of the SSH server's private key, which could enable decryption of captured SSH sessions or device impersonation. Three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the vulnerability affects a shared firmware/software base across multiple vendor OEM implementations. No public exploit or KEV listing identified at time of analysis.
Remote code execution is achievable on Pepperl+Fuchs ICE2/ICE3-series IO-Link Master devices and the Phoenix Contact IOL MA8 via a local file inclusion flaw in the `/index.php/ajax/save_iodd_parameters` AJAX endpoint. An authenticated attacker holding a valid operator-level session cookie can supply a crafted filename parameter that causes the PHP runtime to include and execute an attacker-controlled file, yielding full device compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation requires prior acquisition of operator credentials.
Remote code execution via PHP local file inclusion on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM equivalents (Phoenix Contact, Indu-Sol variants) allows a low-privileged authenticated attacker to execute arbitrary PHP code by supplying a crafted parameter to the /index.php/ajax/get_iodd_port_info endpoint. The vulnerability requires only a valid user session cookie, making it accessible to any account holder on these industrial automation gateways. Three separate CERT VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware is shipped under at least three different vendor brands, broadening the affected fleet across OT environments. No public exploit code or active exploitation has been identified at time of analysis.
Command injection via the PHP-based IODD parameter save endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link masters and OEM-equivalent devices allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. Affected hardware includes multiple ICE2 and ICE3 form-factor variants from Pepperl+Fuchs and the Phoenix Contact IOL MA8 PN DI8, with additional OEM-labeled variants covered under three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper authorization on the IODD file upload endpoint of multiple Pepperl+Fuchs ICE2 and ICE3 IO-Link master devices, as well as Phoenix Contact IOL MA8 PN DI8 units, permits any low-privileged authenticated remote user to upload IO-Link Device Description (IODD) files without the privilege level required for that operation. Successful exploitation can silently alter how connected IO-Link sensors and actuators are configured or interpreted by the master, or crash the device entirely by supplying malformed IODD content. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM variants from Phoenix Contact and others) allows a low-privileged authenticated remote attacker to execute arbitrary OS commands with root privileges via the PHP-based /index.php/ajax/parameterManage endpoint. The flaw is tracked across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating the vulnerable firmware is shared across multiple vendor rebrand families. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Command injection via the Field_Shadow_Password class in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL_MA8_PN_DI8 allows a network-authenticated attacker holding only operator-level credentials to inject OS commands that execute with root privileges on the device. The vulnerability (CWE-78) is exploitable without user interaction against a low-privileged account, resulting in full confidentiality, integrity, and availability compromise of the affected industrial device. No public exploit code or CISA KEV listing has been identified at time of analysis; three coordinated CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) cover multiple vendor families sharing the same underlying platform.
Command injection in Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL_MA8 IO-Link master devices enables an authenticated low-privileged attacker to execute arbitrary OS commands as root via the /index.php/attached_devices_tab/do_upload web management endpoint. The vulnerability (CWE-78) is exploitable remotely without user interaction using only operator-level credentials, yielding full device compromise including confidentiality, integrity, and availability of the industrial gateway. No public exploit code or CISA KEV listing has been identified at time of analysis, though three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate coordinated multi-vendor disclosure.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and OEM equivalents allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the /index.php/ajax/get_iodd_port_info PHP endpoint. Affected hardware spans multiple ICE2 and ICE3 form factors (G65L, K45P, K45S housings) as well as Phoenix Contact IOL MA8 and additional OEM-branded variants sharing the same firmware. No public exploit code has been identified at time of analysis, but the low attack complexity and high impact make this a credible priority in any industrial network where these devices are reachable.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM equivalents from Phoenix Contact and others) allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the PHP endpoint /index.php/ajax/get_iodd_menu_info. Any valid user or operator account - the lowest access tiers on the device - is sufficient to achieve full device compromise. No public exploit has been identified at time of analysis, but the vulnerability is straightforward (CWE-78) and reported across three separate CERTVDE advisories covering multiple vendor SKUs, indicating a shared firmware base.
Authentication bypass in Pepperl+Fuchs ICE2/ICE3-series IO-Link masters (and OEM-equivalent Phoenix Contact IOL-MA8 modules) lets a remote unauthenticated attacker reach the _account_log function and authenticate as administrator, even on devices where accounts are correctly provisioned. The flaw grants full administrative control of the device management interface with no credentials. Reported by CERT@VDE; no public exploit code and no active-exploitation evidence are present in the available data, though the CVSS 9.8 rating reflects trivial exploitability.
Information disclosure in Phoenix Contact CHARX SEC-3000/3050/3100/3150 EV charging controllers allows an unauthenticated attacker on an adjacent network to download controller log files containing restricted information. No public exploit identified at time of analysis, but the low attack complexity and lack of authentication make opportunistic abuse straightforward once an attacker reaches the same network segment. Reported via CERT@VDE under advisory VDE-2026-060.
A CSRF vulnerability in A CSRF vulnerability in the Link Aggregation configuration interface (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerability requiring prompt remediation.
A cross-site scripting vulnerability (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerability requiring prompt remediation.
Arbitrary command execution with root privileges affects multiple Fl Switch and Fl Nat devices through improper handling of HTTP POST requests in the Root CA certificate transfer workflow. An authenticated high-privileged attacker can exploit this command injection flaw to execute arbitrary commands on the underlying Linux operating system. No patch is currently available for the affected product versions.
Password hash disclosure in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and Phoenix Contact IOL MA8 PN DI8 (plus OEM variants) exposes all user credential hashes to any authenticated low-privileged user. The PHP-based diagnostics endpoint `/index.php/diagnostics_tab/ajax_diag_table_rows` accepts a manipulable `schema` path parameter that, when tampered with using a valid session cookie, causes the server to return the device's full user credential hash store. No public exploit or active exploitation has been identified at time of analysis; three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same underlying vulnerability spans multiple vendor product lines sharing common firmware.
SQL injection in Phoenix Contact PLCnext controller web interfaces exposes a notification message SQLite database to manipulation by authenticated low-privilege users. The vulnerable endpoint is network-accessible with no attack requirements beyond a valid low-privilege account, making it trivially exploitable from any networked workstation in OT environments where such accounts exist. Impact is deliberately bounded by design to the notification subsystem - core PLC control logic, I/O, and safety functions are not affected - but notification tampering in industrial contexts may suppress or falsify operational alerts. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Unauthenticated remote denial-of-service in Phoenix Contact's PLCnext Engineer communication interface allows any network-accessible attacker to interrupt engineering access to a broad range of Phoenix Contact industrial controllers. Exploitation triggers CWE-770 resource exhaustion in the PLCnext service, causing it to stop accepting connections from the PLCnext Engineer client application. Recovery requires a manual service restart - an operationally significant constraint in industrial environments where unplanned downtime carries physical and safety implications. No public exploit code is known, and the vulnerability is not listed in CISA KEV at time of analysis.
Remote code execution and denial-of-service in Phoenix Contact PLCnext-family industrial controllers (AXC F 1152/1252/2152/3152, RFC 4072R/S, BPC 9102S/9202S, VPLCnext Control, EPC 15xx and others) arise from a buffer overflow in the PROFINET service that is reachable in the default configuration. An unauthenticated remote attacker on the network can crash/reboot the device or execute arbitrary code, per the vendor CVSS 4.0 rating of 9.3 (critical). This is a CWE-120 classic buffer overflow reported by CERT@VDE; no public exploit identified at time of analysis and it is not on CISA KEV.
A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity.
A buffer overflow vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A buffer overflow vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Denial of service in Stack Overflow and Fl networking devices results from a stack-based buffer overflow in the file installation workflow that can be triggered by high-privileged attackers through oversized POST parameters. An authenticated attacker with elevated privileges can crash the affected service by exploiting this memory corruption vulnerability. No patch is currently available for the impacted products.
A buffer overflow vulnerability (CVSS 4.9) that allows a high-privileged attacker. Remediation should follow standard vulnerability management procedures.
A buffer overflow vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Cross-site scripting in the pxc_portCntr2.php endpoint of the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT industrial Ethernet switches allows an unauthenticated remote attacker (PR:N) to socially engineer a currently authenticated operator into submitting an attacker-crafted POST request that alters device configuration parameters exposed by the web application (CVSS 7.1, UI:R, scope changed). Impact is bounded: the vulnerability does not reach operating system internals or privileged functions, and the httpOnly session-cookie flag prevents the injected script from stealing or hijacking the authenticated session. EPSS is low (0.65%, ~49th percentile) and no public exploit or confirmed active exploitation was identified at time of analysis; success depends entirely on tricking an authenticated user into interacting with attacker-supplied content.
Remote command injection in Phoenix Contact's Web-based Management (WBM) interface lets an authenticated low-privileged user execute arbitrary commands as root by altering system configuration, resulting in complete loss of confidentiality, integrity, and availability on the affected device. The flaw requires a valid WBM account (CVSS PR:L) and network reachability to the management interface; EPSS is 0.85% (57th percentile) and no public exploit was identified at time of analysis. It is a serious issue that warrants prioritization, but exposure is materially lower where WBM is isolated on OT/management segments and low-tier accounts are tightly controlled.
Root-level remote code execution affects Pepperl+Fuchs ICE2/ICE3-series and Phoenix Contact IOL-MA8 IO-Link master gateways, where an unauthenticated attacker uploads a crafted IODD (IO Device Description) file that drops and executes an arbitrary shell script as root. The injected script survives reboot, granting persistent full control of the industrial device. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the CVSS 9.8 rating reflects trivial network reachability and complete device compromise.
Command injection via the `/api/datastorage/data` REST API endpoint in Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL-MA8 IO-Link master devices allows an authenticated administrator to execute arbitrary OS commands with root privileges by sending a crafted HTTP PUT request. The flaw spans multiple hardware variants from both vendors and is disclosed across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating broad impact across related product families. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Command injection on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM-equivalent variants (Phoenix Contact IOL-MA8, and others) allows an authenticated remote admin to execute arbitrary OS commands as root via a crafted GET request to the /api/datastorage/data endpoint. The vulnerability is reported across at least three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating coordinated multi-vendor OEM disclosure spanning Pepperl+Fuchs, Phoenix Contact, and additional industrial automation suppliers. No public exploit code or active exploitation has been identified at time of analysis, but the industrial OT context raises availability and safety concern disproportionate to a purely IT risk framing.
Command injection in the web management API of Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL MA8 enables an authenticated admin-level attacker to execute arbitrary OS commands as root via a crafted PUT request to the /api/iodd/config endpoint. All firmware versions of at least nine Pepperl+Fuchs ICE2/ICE3 hardware variants and the Phoenix Contact IOL MA8 PN DI8 are confirmed affected across three CERT@VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation is identified at time of analysis, but full root compromise of an industrial field device represents a significant ICS/OT risk.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and related Phoenix Contact hardware allows a remote attacker holding valid admin credentials to execute arbitrary OS commands with root privileges via a crafted GET request to the /api/iodd/config endpoint. The vulnerability is confirmed by three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating it spans multiple vendor product lines and firmware variants. No public exploit or active exploitation is identified at time of analysis, but root-level code execution on OT network edge devices represents a significant lateral-movement and persistence risk in industrial environments.
Command injection in the Pepperl+Fuchs ICE2/ICE3 IO-Link Master firmware - and functionally equivalent Phoenix Contact IOL-MA8 variants - allows a remote admin-authenticated attacker to achieve root-level OS command execution by sending a crafted DELETE request to the `/api/status/data` REST API endpoint. All currently listed firmware versions across the ICE2 and ICE3 product lines are affected, with no upper version bound in NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor-assigned CVSS 7.2 appropriately reflects the PR:H prerequisite that meaningfully gates exploitation to scenarios where admin credentials are already available to the attacker.
Command injection in Pepperl+Fuchs ICE2/ICE3 and Phoenix Contact IOL MA8 series IO-Link Master devices allows a low-privileged remote attacker to execute arbitrary OS commands with root privileges by sending a crafted GET request to the /api/status/data REST endpoint. Three separate CERTVDE coordinated advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware stack is shared across multiple industrial automation vendors, broadening the effective attack surface beyond any single manufacturer. No public exploit code or active exploitation has been identified at time of analysis.
Command injection via a PHP web management endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link Masters and Phoenix Contact IOL_MA8_PN_DI8 allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. The vulnerable endpoint, `/index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files`, passes user-supplied filenames to an underlying OS command without sanitization, enabling full device compromise. No public exploit code or KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a serious risk in OT/ICS environments.
Path traversal in the PHP web management interface of Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL MA8 IO-Link master devices allows unauthenticated remote attackers to read arbitrary files via the /index.php/view_uploaded_iodd_file endpoint. The most critical disclosed impact is exfiltration of the SSH server's private key, which could enable decryption of captured SSH sessions or device impersonation. Three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the vulnerability affects a shared firmware/software base across multiple vendor OEM implementations. No public exploit or KEV listing identified at time of analysis.
Remote code execution is achievable on Pepperl+Fuchs ICE2/ICE3-series IO-Link Master devices and the Phoenix Contact IOL MA8 via a local file inclusion flaw in the `/index.php/ajax/save_iodd_parameters` AJAX endpoint. An authenticated attacker holding a valid operator-level session cookie can supply a crafted filename parameter that causes the PHP runtime to include and execute an attacker-controlled file, yielding full device compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation requires prior acquisition of operator credentials.
Remote code execution via PHP local file inclusion on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM equivalents (Phoenix Contact, Indu-Sol variants) allows a low-privileged authenticated attacker to execute arbitrary PHP code by supplying a crafted parameter to the /index.php/ajax/get_iodd_port_info endpoint. The vulnerability requires only a valid user session cookie, making it accessible to any account holder on these industrial automation gateways. Three separate CERT VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware is shipped under at least three different vendor brands, broadening the affected fleet across OT environments. No public exploit code or active exploitation has been identified at time of analysis.
Command injection via the PHP-based IODD parameter save endpoint on Pepperl+Fuchs ICE2/ICE3 series IO-Link masters and OEM-equivalent devices allows an authenticated operator-level attacker to execute arbitrary OS commands with root privileges on the device. Affected hardware includes multiple ICE2 and ICE3 form-factor variants from Pepperl+Fuchs and the Phoenix Contact IOL MA8 PN DI8, with additional OEM-labeled variants covered under three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Improper authorization on the IODD file upload endpoint of multiple Pepperl+Fuchs ICE2 and ICE3 IO-Link master devices, as well as Phoenix Contact IOL MA8 PN DI8 units, permits any low-privileged authenticated remote user to upload IO-Link Device Description (IODD) files without the privilege level required for that operation. Successful exploitation can silently alter how connected IO-Link sensors and actuators are configured or interpreted by the master, or crash the device entirely by supplying malformed IODD content. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM variants from Phoenix Contact and others) allows a low-privileged authenticated remote attacker to execute arbitrary OS commands with root privileges via the PHP-based /index.php/ajax/parameterManage endpoint. The flaw is tracked across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating the vulnerable firmware is shared across multiple vendor rebrand families. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Command injection via the Field_Shadow_Password class in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL_MA8_PN_DI8 allows a network-authenticated attacker holding only operator-level credentials to inject OS commands that execute with root privileges on the device. The vulnerability (CWE-78) is exploitable without user interaction against a low-privileged account, resulting in full confidentiality, integrity, and availability compromise of the affected industrial device. No public exploit code or CISA KEV listing has been identified at time of analysis; three coordinated CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) cover multiple vendor families sharing the same underlying platform.
Command injection in Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL_MA8 IO-Link master devices enables an authenticated low-privileged attacker to execute arbitrary OS commands as root via the /index.php/attached_devices_tab/do_upload web management endpoint. The vulnerability (CWE-78) is exploitable remotely without user interaction using only operator-level credentials, yielding full device compromise including confidentiality, integrity, and availability of the industrial gateway. No public exploit code or CISA KEV listing has been identified at time of analysis, though three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate coordinated multi-vendor disclosure.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and OEM equivalents allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the /index.php/ajax/get_iodd_port_info PHP endpoint. Affected hardware spans multiple ICE2 and ICE3 form factors (G65L, K45P, K45S housings) as well as Phoenix Contact IOL MA8 and additional OEM-branded variants sharing the same firmware. No public exploit code has been identified at time of analysis, but the low attack complexity and high impact make this a credible priority in any industrial network where these devices are reachable.
Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM equivalents from Phoenix Contact and others) allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the PHP endpoint /index.php/ajax/get_iodd_menu_info. Any valid user or operator account - the lowest access tiers on the device - is sufficient to achieve full device compromise. No public exploit has been identified at time of analysis, but the vulnerability is straightforward (CWE-78) and reported across three separate CERTVDE advisories covering multiple vendor SKUs, indicating a shared firmware base.
Authentication bypass in Pepperl+Fuchs ICE2/ICE3-series IO-Link masters (and OEM-equivalent Phoenix Contact IOL-MA8 modules) lets a remote unauthenticated attacker reach the _account_log function and authenticate as administrator, even on devices where accounts are correctly provisioned. The flaw grants full administrative control of the device management interface with no credentials. Reported by CERT@VDE; no public exploit code and no active-exploitation evidence are present in the available data, though the CVSS 9.8 rating reflects trivial exploitability.
Information disclosure in Phoenix Contact CHARX SEC-3000/3050/3100/3150 EV charging controllers allows an unauthenticated attacker on an adjacent network to download controller log files containing restricted information. No public exploit identified at time of analysis, but the low attack complexity and lack of authentication make opportunistic abuse straightforward once an attacker reaches the same network segment. Reported via CERT@VDE under advisory VDE-2026-060.
A CSRF vulnerability in A CSRF vulnerability in the Link Aggregation configuration interface (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerability requiring prompt remediation.
A cross-site scripting vulnerability (CVSS 7.1) that allows an unauthenticated remote attacker. High severity vulnerability requiring prompt remediation.
Arbitrary command execution with root privileges affects multiple Fl Switch and Fl Nat devices through improper handling of HTTP POST requests in the Root CA certificate transfer workflow. An authenticated high-privileged attacker can exploit this command injection flaw to execute arbitrary commands on the underlying Linux operating system. No patch is currently available for the affected product versions.
Password hash disclosure in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and Phoenix Contact IOL MA8 PN DI8 (plus OEM variants) exposes all user credential hashes to any authenticated low-privileged user. The PHP-based diagnostics endpoint `/index.php/diagnostics_tab/ajax_diag_table_rows` accepts a manipulable `schema` path parameter that, when tampered with using a valid session cookie, causes the server to return the device's full user credential hash store. No public exploit or active exploitation has been identified at time of analysis; three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same underlying vulnerability spans multiple vendor product lines sharing common firmware.
SQL injection in Phoenix Contact PLCnext controller web interfaces exposes a notification message SQLite database to manipulation by authenticated low-privilege users. The vulnerable endpoint is network-accessible with no attack requirements beyond a valid low-privilege account, making it trivially exploitable from any networked workstation in OT environments where such accounts exist. Impact is deliberately bounded by design to the notification subsystem - core PLC control logic, I/O, and safety functions are not affected - but notification tampering in industrial contexts may suppress or falsify operational alerts. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Unauthenticated remote denial-of-service in Phoenix Contact's PLCnext Engineer communication interface allows any network-accessible attacker to interrupt engineering access to a broad range of Phoenix Contact industrial controllers. Exploitation triggers CWE-770 resource exhaustion in the PLCnext service, causing it to stop accepting connections from the PLCnext Engineer client application. Recovery requires a manual service restart - an operationally significant constraint in industrial environments where unplanned downtime carries physical and safety implications. No public exploit code is known, and the vulnerability is not listed in CISA KEV at time of analysis.
Remote code execution and denial-of-service in Phoenix Contact PLCnext-family industrial controllers (AXC F 1152/1252/2152/3152, RFC 4072R/S, BPC 9102S/9202S, VPLCnext Control, EPC 15xx and others) arise from a buffer overflow in the PROFINET service that is reachable in the default configuration. An unauthenticated remote attacker on the network can crash/reboot the device or execute arbitrary code, per the vendor CVSS 4.0 rating of 9.3 (critical). This is a CWE-120 classic buffer overflow reported by CERT@VDE; no public exploit identified at time of analysis and it is not on CISA KEV.
A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity.
A buffer overflow vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A buffer overflow vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Denial of service in Stack Overflow and Fl networking devices results from a stack-based buffer overflow in the file installation workflow that can be triggered by high-privileged attackers through oversized POST parameters. An authenticated attacker with elevated privileges can crash the affected service by exploiting this memory corruption vulnerability. No patch is currently available for the impacted products.
A buffer overflow vulnerability (CVSS 4.9) that allows a high-privileged attacker. Remediation should follow standard vulnerability management procedures.
A buffer overflow vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Cross-site scripting in the pxc_portCntr2.php endpoint of the web-based management (WBM) interface of Phoenix Contact FL SWITCH and FL NAT industrial Ethernet switches allows an unauthenticated remote attacker (PR:N) to socially engineer a currently authenticated operator into submitting an attacker-crafted POST request that alters device configuration parameters exposed by the web application (CVSS 7.1, UI:R, scope changed). Impact is bounded: the vulnerability does not reach operating system internals or privileged functions, and the httpOnly session-cookie flag prevents the injected script from stealing or hijacking the authenticated session. EPSS is low (0.65%, ~49th percentile) and no public exploit or confirmed active exploitation was identified at time of analysis; success depends entirely on tricking an authenticated user into interacting with attacker-supplied content.
Remote command injection in Phoenix Contact's Web-based Management (WBM) interface lets an authenticated low-privileged user execute arbitrary commands as root by altering system configuration, resulting in complete loss of confidentiality, integrity, and availability on the affected device. The flaw requires a valid WBM account (CVSS PR:L) and network reachability to the management interface; EPSS is 0.85% (57th percentile) and no public exploit was identified at time of analysis. It is a serious issue that warrants prioritization, but exposure is materially lower where WBM is isolated on OT/management segments and low-tier accounts are tightly controlled.