← All Advisories

Unauthenticated IODD File Upload on Pepperl+Fuchs ICE-Series IO-Link Masters Executes a Root Shell Script That Persists Across Reboots

Last refreshed2026-09-30

Status: UPDATED  |  Advisory ID: CVE-2026-27565

Key Details

CVECVE-2026-27565
CVSS Score / Version9.8 (Critical) / CVSS v3.1
Updated2026-09-16
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Proseattack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected productssee table below
Classified asCWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
Pepperl+FuchsICE2-8IOL-K45P-RJ45
Pepperl+FuchsICE2-8IOL1-G65L-V1D
Pepperl+FuchsICE2-8IOL-G65L-V1D
Pepperl+FuchsICE2-8IOL-K45S-RJ45
Pepperl+FuchsICE3-8IOL1-G65L-V1D
Pepperl+FuchsICE3-8IOL-G65L-V1D
Pepperl+FuchsICE3-8IOL-G65L-V1D-Y
Pepperl+FuchsICE3-8IOL-K45P-RJ45
Pepperl+FuchsICE3-8IOL-K45S-RJ45
Phoenix ContactIOL MA8 PN DI8
Phoenix ContactIOL MA8 EIP DI8
Carlo Gavazzi AutomationYL212CEI8M1IO
Carlo Gavazzi AutomationYN115CEI8RPIO
Carlo Gavazzi AutomationYL212CPN8M1IO
Carlo Gavazzi AutomationYN115CPN8RPIO
SubsystemsGeneral OT
SectorsMultiple

What to Know

An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot. (NVD)

What to Do

Monitor Pepperl+Fuchs, Phoenix Contact, and Carlo Gavazzi Automation's web pages for any future patch releases.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-27565
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-27565

About

OT-Advisories  ·  CVE  ·  NVD  ·  CVSS  ·  KEV  ·  EPSS  ·  CWE