42
CVEs
7
Critical
27
High
0
KEV
6
PoC
15
Unpatched C/H
50.0%
Patch Rate
4.1%
Avg EPSS
Severity Breakdown
CRITICAL
7
HIGH
27
MEDIUM
7
LOW
1
Monthly CVE Trend
Affected Products (30)
Ice3 8Iol G65L V1D
20
Ice3 8Iol1 G65L V1D
20
Ice3 8Iol K45S Rj45
20
Yl212Cei8M1Io
20
Yn115Cpn8Rpio
20
Ice2 8Iol G65L V1D
20
Yn115Cei8Rpio
20
Iol Ma8 Eip Di8
20
Ice2 8Iol K45P Rj45
20
Iol Ma8 Pn Di8
20
Ice2 8Iol K45S Rj45
20
Ice3 8Iol K45P Rj45
20
Yl212Cpn8M1Io
20
Ice2 8Iol1 G65L V1D
20
Ice3 8Iol G65L V1D Y
20
PHP
11
Wha Gw F2D2 0 As Z2 Eth Firmware
8
Wha Gw F2D2 0 As Z2 Eth Eip Firmware
8
Es7506 Firmware
5
Es8508 Firmware
5
Es9528 Xtv2 Firmware
5
Es8509 Xt Firmware
5
Es7510 Firmware
5
Es8510 Firmware
5
Es7510 Xt Firmware
5
Es7528 Firmware
5
Es8508F Firmware
5
Es8510 Xt Firmware
5
Es8510 Xte Firmware
5
Es9528 Firmware
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2017-5753 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Rated medium severity (CVSS 5.6). Public exploit code available and EPSS exploitation probability 94.3%. | MEDIUM | 5.6 | 94.3% | 142 |
PoC
|
| CVE-2020-12500 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 2.9% | 69 |
PoC
No patch
|
| CVE-2020-12501 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 3.3% | 69 |
PoC
No patch
|
| CVE-2020-12504 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 3.0% | 69 |
PoC
No patch
|
| CVE-2020-12502 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 1.0% | 64 |
PoC
No patch
|
| CVE-2020-12503 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE,. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.2 | 23.3% | 56 |
PoC
No patch
|
| CVE-2026-27546 | Authentication bypass in Pepperl+Fuchs ICE2/ICE3-series IO-Link masters (and OEM-equivalent Phoenix Contact IOL-MA8 modules) lets a remote unauthenticated attacker reach the _account_log function and authenticate as administrator, even on devices where accounts are correctly provisioned. The flaw grants full administrative control of the device management interface with no credentials. Reported by CERT@VDE; no public exploit code and no active-exploitation evidence are present in the available data, though the CVSS 9.8 rating reflects trivial exploitability. | CRITICAL | 9.8 | 1.0% | 50 |
|
| CVE-2026-27565 | Root-level remote code execution affects Pepperl+Fuchs ICE2/ICE3-series and Phoenix Contact IOL-MA8 IO-Link master gateways, where an unauthenticated attacker uploads a crafted IODD (IO Device Description) file that drops and executes an arbitrary shell script as root. The injected script survives reboot, granting persistent full control of the industrial device. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the CVSS 9.8 rating reflects trivial network reachability and complete device compromise. | CRITICAL | 9.8 | 0.9% | 50 |
|
| CVE-2021-34565 | In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.0% | 49 |
No patch
|
| CVE-2024-6422 | An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.6% | 49 |
No patch
|
| CVE-2026-27547 | Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM equivalents from Phoenix Contact and others) allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the PHP endpoint /index.php/ajax/get_iodd_menu_info. Any valid user or operator account - the lowest access tiers on the device - is sufficient to achieve full device compromise. No public exploit has been identified at time of analysis, but the vulnerability is straightforward (CWE-78) and reported across three separate CERTVDE advisories covering multiple vendor SKUs, indicating a shared firmware base. | HIGH | 8.8 | 2.1% | 46 |
|
| CVE-2026-27548 | Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and OEM equivalents allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the /index.php/ajax/get_iodd_port_info PHP endpoint. Affected hardware spans multiple ICE2 and ICE3 form factors (G65L, K45P, K45S housings) as well as Phoenix Contact IOL MA8 and additional OEM-branded variants sharing the same firmware. No public exploit code has been identified at time of analysis, but the low attack complexity and high impact make this a credible priority in any industrial network where these devices are reachable. | HIGH | 8.8 | 2.1% | 46 |
|
| CVE-2026-27549 | Command injection in Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL_MA8 IO-Link master devices enables an authenticated low-privileged attacker to execute arbitrary OS commands as root via the /index.php/attached_devices_tab/do_upload web management endpoint. The vulnerability (CWE-78) is exploitable remotely without user interaction using only operator-level credentials, yielding full device compromise including confidentiality, integrity, and availability of the industrial gateway. No public exploit code or CISA KEV listing has been identified at time of analysis, though three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate coordinated multi-vendor disclosure. | HIGH | 8.8 | 2.1% | 46 |
|
| CVE-2026-27550 | Command injection via the Field_Shadow_Password class in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL_MA8_PN_DI8 allows a network-authenticated attacker holding only operator-level credentials to inject OS commands that execute with root privileges on the device. The vulnerability (CWE-78) is exploitable without user interaction against a low-privileged account, resulting in full confidentiality, integrity, and availability compromise of the affected industrial device. No public exploit code or CISA KEV listing has been identified at time of analysis; three coordinated CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) cover multiple vendor families sharing the same underlying platform. | HIGH | 8.8 | 2.1% | 46 |
|
| CVE-2026-27551 | Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM variants from Phoenix Contact and others) allows a low-privileged authenticated remote attacker to execute arbitrary OS commands with root privileges via the PHP-based /index.php/ajax/parameterManage endpoint. The flaw is tracked across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating the vulnerable firmware is shared across multiple vendor rebrand families. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis. | HIGH | 8.8 | 2.1% | 46 |
|