14
CVEs
2
Critical
11
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
9.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
11
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (30)
Ice3 8Iol1 G65L V1D
9
Yn115Cpn8Rpio
9
Ice2 8Iol1 G65L V1D
9
Ice2 8Iol G65L V1D
9
Ice3 8Iol K45S Rj45
9
Ice3 8Iol G65L V1D
9
Ice2 8Iol K45S Rj45
9
Iol Ma8 Pn Di8
9
Iol Ma8 Eip Di8
9
Yn115Cei8Rpio
9
Yl212Cei8M1Io
9
Ice2 8Iol K45P Rj45
9
Yl212Cpn8M1Io
9
Ice3 8Iol K45P Rj45
9
Ice3 8Iol G65L V1D Y
9
Fl Switch 2216
8
Fl Switch 2212 2tc 2sfx
8
Fl Switch 2608
8
Fl Switch 2108
8
Fl Switch 2506 2sfp
8
Fl Switch 2306 2sfp
8
Fl Switch 2206 2fx
8
Fl Switch 2414 2sfx Pn
8
Fl Switch 2314 2sfp Pn
8
Fl Switch 2408
8
Fl Switch 2206 2sfx Pn
8
Fl Switch 2708 Pn
8
Fl Switch 2214 2sfx
8
Fl Switch Tsn 2316
8
Fl Switch 2508 K1
8
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-41769 | Remote code execution and denial-of-service in Phoenix Contact PLCnext-family industrial controllers (AXC F 1152/1252/2152/3152, RFC 4072R/S, BPC 9102S/9202S, VPLCnext Control, EPC 15xx and others) arise from a buffer overflow in the PROFINET service that is reachable in the default configuration. An unauthenticated remote attacker on the network can crash/reboot the device or execute arbitrary code, per the vendor CVSS 4.0 rating of 9.3 (critical). This is a CWE-120 classic buffer overflow reported by CERT@VDE; no public exploit identified at time of analysis and it is not on CISA KEV. | CRITICAL | 9.3 | 59.0% | 106 |
|
| CVE-2025-41770 | Unauthenticated remote denial-of-service in Phoenix Contact's PLCnext Engineer communication interface allows any network-accessible attacker to interrupt engineering access to a broad range of Phoenix Contact industrial controllers. Exploitation triggers CWE-770 resource exhaustion in the PLCnext service, causing it to stop accepting connections from the PLCnext Engineer client application. Recovery requires a manual service restart - an operationally significant constraint in industrial environments where unplanned downtime carries physical and safety implications. No public exploit code is known, and the vulnerability is not listed in CISA KEV at time of analysis. | HIGH | 8.7 | 39.0% | 82 |
|
| CVE-2026-27546 | Authentication bypass in Pepperl+Fuchs ICE2/ICE3-series IO-Link masters (and OEM-equivalent Phoenix Contact IOL-MA8 modules) lets a remote unauthenticated attacker reach the _account_log function and authenticate as administrator, even on devices where accounts are correctly provisioned. The flaw grants full administrative control of the device management interface with no credentials. Reported by CERT@VDE; no public exploit code and no active-exploitation evidence are present in the available data, though the CVSS 9.8 rating reflects trivial exploitability. | CRITICAL | 9.8 | 1.0% | 49 |
|
| CVE-2026-27547 | Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM equivalents from Phoenix Contact and others) allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the PHP endpoint /index.php/ajax/get_iodd_menu_info. Any valid user or operator account - the lowest access tiers on the device - is sufficient to achieve full device compromise. No public exploit has been identified at time of analysis, but the vulnerability is straightforward (CWE-78) and reported across three separate CERTVDE advisories covering multiple vendor SKUs, indicating a shared firmware base. | HIGH | 8.8 | 2.1% | 46 |
|
| CVE-2026-27548 | Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and OEM equivalents allows a low-privileged authenticated attacker to execute arbitrary OS commands as root via the /index.php/ajax/get_iodd_port_info PHP endpoint. Affected hardware spans multiple ICE2 and ICE3 form factors (G65L, K45P, K45S housings) as well as Phoenix Contact IOL MA8 and additional OEM-branded variants sharing the same firmware. No public exploit code has been identified at time of analysis, but the low attack complexity and high impact make this a credible priority in any industrial network where these devices are reachable. | HIGH | 8.8 | 2.1% | 44 |
|
| CVE-2026-27549 | Command injection in Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL_MA8 IO-Link master devices enables an authenticated low-privileged attacker to execute arbitrary OS commands as root via the /index.php/attached_devices_tab/do_upload web management endpoint. The vulnerability (CWE-78) is exploitable remotely without user interaction using only operator-level credentials, yielding full device compromise including confidentiality, integrity, and availability of the industrial gateway. No public exploit code or CISA KEV listing has been identified at time of analysis, though three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate coordinated multi-vendor disclosure. | HIGH | 8.8 | 2.1% | 44 |
|
| CVE-2026-27550 | Command injection via the Field_Shadow_Password class in Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL_MA8_PN_DI8 allows a network-authenticated attacker holding only operator-level credentials to inject OS commands that execute with root privileges on the device. The vulnerability (CWE-78) is exploitable without user interaction against a low-privileged account, resulting in full confidentiality, integrity, and availability compromise of the affected industrial device. No public exploit code or CISA KEV listing has been identified at time of analysis; three coordinated CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) cover multiple vendor families sharing the same underlying platform. | HIGH | 8.8 | 2.1% | 44 |
|
| CVE-2026-27551 | Command injection in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices (and OEM variants from Phoenix Contact and others) allows a low-privileged authenticated remote attacker to execute arbitrary OS commands with root privileges via the PHP-based /index.php/ajax/parameterManage endpoint. The flaw is tracked across three CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028), indicating the vulnerable firmware is shared across multiple vendor rebrand families. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis. | HIGH | 8.8 | 2.1% | 44 |
|
| CVE-2025-41771 | SQL injection in Phoenix Contact PLCnext controller web interfaces exposes a notification message SQLite database to manipulation by authenticated low-privilege users. The vulnerable endpoint is network-accessible with no attack requirements beyond a valid low-privilege account, making it trivially exploitable from any networked workstation in OT environments where such accounts exist. Impact is deliberately bounded by design to the notification subsystem - core PLC control logic, I/O, and safety functions are not affected - but notification tampering in industrial contexts may suppress or falsify operational alerts. No public exploit code exists and no CISA KEV listing is present at time of analysis. | MEDIUM | 5.3 | 16.0% | 42 |
|
| CVE-2026-27552 | Improper authorization on the IODD file upload endpoint of multiple Pepperl+Fuchs ICE2 and ICE3 IO-Link master devices, as well as Phoenix Contact IOL MA8 PN DI8 units, permits any low-privileged authenticated remote user to upload IO-Link Device Description (IODD) files without the privilege level required for that operation. Successful exploitation can silently alter how connected IO-Link sensors and actuators are configured or interpreted by the master, or crash the device entirely by supplying malformed IODD content. No public exploit code and no CISA KEV listing have been identified at time of analysis. | HIGH | 8.1 | 0.6% | 41 |
|
| CVE-2024-43384 | A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. | HIGH | 8.0 | 0.0% | 40 |
|
| CVE-2026-27562 | Command injection in the web management API of Pepperl+Fuchs ICE2/ICE3 IO-Link master devices and Phoenix Contact IOL MA8 enables an authenticated admin-level attacker to execute arbitrary OS commands as root via a crafted PUT request to the /api/iodd/config endpoint. All firmware versions of at least nine Pepperl+Fuchs ICE2/ICE3 hardware variants and the Phoenix Contact IOL MA8 PN DI8 are confirmed affected across three CERT@VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028). No public exploit code or active exploitation is identified at time of analysis, but full root compromise of an industrial field device represents a significant ICS/OT risk. | HIGH | 7.2 | 2.2% | 38 |
|
| CVE-2026-27557 | Path traversal in the PHP web management interface of Pepperl+Fuchs ICE2/ICE3 series and Phoenix Contact IOL MA8 IO-Link master devices allows unauthenticated remote attackers to read arbitrary files via the /index.php/view_uploaded_iodd_file endpoint. The most critical disclosed impact is exfiltration of the SSH server's private key, which could enable decryption of captured SSH sessions or device impersonation. Three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the vulnerability affects a shared firmware/software base across multiple vendor OEM implementations. No public exploit or KEV listing identified at time of analysis. | HIGH | 7.5 | 0.7% | 38 |
|
| CVE-2026-41032 | Information disclosure in Phoenix Contact CHARX SEC-3000/3050/3100/3150 EV charging controllers allows an unauthenticated attacker on an adjacent network to download controller log files containing restricted information. No public exploit identified at time of analysis, but the low attack complexity and lack of authentication make opportunistic abuse straightforward once an attacker reaches the same network segment. Reported via CERT@VDE under advisory VDE-2026-060. | HIGH | 7.5 | 0.0% | 38 |
|