Remote code execution via uploading a malicious IODD file
Priority MEDIUM 51CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00969 62nd percentileScored 2026-11-07
Fix Fixed ICE2-8IOL1-G65L-V1D (Pepperl+Fuchs): 1.7.4ICE2-8IOL-G65L-V1D (Pepperl+Fuchs): 1.7.4+13 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pepperl+Fuchs | ICE2-8IOL1-G65L-V1D | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Pepperl+Fuchs | ICE2-8IOL-G65L-V1D | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Pepperl+Fuchs | ICE2-8IOL-K45P-RJ45 | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Pepperl+Fuchs | ICE2-8IOL-K45S-RJ45 | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Pepperl+Fuchs | ICE3-8IOL1-G65L-V1D | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Pepperl+Fuchs | ICE3-8IOL-G65L-V1D | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Pepperl+Fuchs | ICE3-8IOL-G65L-V1D-Y | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Pepperl+Fuchs | ICE3-8IOL-K45P-RJ45 | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Pepperl+Fuchs | ICE3-8IOL-K45S-RJ45 | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Phoenix Contact | IOL MA8 PN DI8 | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Phoenix Contact | IOL MA8 EIP DI8 | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Carlo Gavazzi Automation | YL212CEI8M1IO | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Carlo Gavazzi Automation | YN115CEI8RPIO | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Carlo Gavazzi Automation | YL212CPN8M1IO | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
| Carlo Gavazzi Automation | YN115CPN8RPIO | 1.0.0 to before 1.7.4 | 1.7.4 | Patch available | CNA |
- ICE2-8IOL1-G65L-V1D VendorPepperl+Fuchs Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- ICE2-8IOL-G65L-V1D VendorPepperl+Fuchs Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- ICE2-8IOL-K45P-RJ45 VendorPepperl+Fuchs Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- ICE2-8IOL-K45S-RJ45 VendorPepperl+Fuchs Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- ICE3-8IOL1-G65L-V1D VendorPepperl+Fuchs Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- ICE3-8IOL-G65L-V1D VendorPepperl+Fuchs Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- ICE3-8IOL-G65L-V1D-Y VendorPepperl+Fuchs Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- ICE3-8IOL-K45P-RJ45 VendorPepperl+Fuchs Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- ICE3-8IOL-K45S-RJ45 VendorPepperl+Fuchs Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- IOL MA8 PN DI8 VendorPhoenix Contact Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- IOL MA8 EIP DI8 VendorPhoenix Contact Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- YL212CEI8M1IO VendorCarlo Gavazzi Automation Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- YN115CEI8RPIO VendorCarlo Gavazzi Automation Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- YL212CPN8M1IO VendorCarlo Gavazzi Automation Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
- YN115CPN8RPIO VendorCarlo Gavazzi Automation Affected 1.0.0 to before 1.7.4 Fixed in 1.7.4 Patch available CNA
Remediation
- Fix · CNA ICE2-8IOL1-G65L-V1D (Pepperl+Fuchs) Fixed in 1.7.4
- Fix · CNA ICE2-8IOL-G65L-V1D (Pepperl+Fuchs) Fixed in 1.7.4
- Fix · CNA ICE2-8IOL-K45P-RJ45 (Pepperl+Fuchs) Fixed in 1.7.4
- Fix · CNA ICE2-8IOL-K45S-RJ45 (Pepperl+Fuchs) Fixed in 1.7.4
- Fix · CNA ICE3-8IOL1-G65L-V1D (Pepperl+Fuchs) Fixed in 1.7.4
- Fix · CNA ICE3-8IOL-G65L-V1D (Pepperl+Fuchs) Fixed in 1.7.4
- Fix · CNA ICE3-8IOL-G65L-V1D-Y (Pepperl+Fuchs) Fixed in 1.7.4
- Fix · CNA ICE3-8IOL-K45P-RJ45 (Pepperl+Fuchs) Fixed in 1.7.4
- Fix · CNA ICE3-8IOL-K45S-RJ45 (Pepperl+Fuchs) Fixed in 1.7.4
- Fix · CNA IOL MA8 PN DI8 (Phoenix Contact) Fixed in 1.7.4
- Fix · CNA IOL MA8 EIP DI8 (Phoenix Contact) Fixed in 1.7.4
- Fix · CNA YL212CEI8M1IO (Carlo Gavazzi Automation) Fixed in 1.7.4
- Fix · CNA YN115CEI8RPIO (Carlo Gavazzi Automation) Fixed in 1.7.4
- Fix · CNA YL212CPN8M1IO (Carlo Gavazzi Automation) Fixed in 1.7.4
- Fix · CNA YN115CPN8RPIO (Carlo Gavazzi Automation) Fixed in 1.7.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Phoenix Contact IOL MA8 EIP DI8, IOL MA8 PN DI8 1.7.4
20 records Highest priority Priority MEDIUM 13 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-21940 Authentication Bypass in _account_logPriority MEDIUM 51
- TI-2026-21953 Command Injection via GET in /api/status/dataPriority MEDIUM 45
- TI-2026-21952 Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_filesPriority MEDIUM 45
- Release ·
Carlo Gavazzi Automation YL212CEI8M1IO, YL212CPN8M1IO and 2 more products 1.7.4
20 records Highest priority Priority MEDIUM 13 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-21940 Authentication Bypass in _account_logPriority MEDIUM 51
- TI-2026-21953 Command Injection via GET in /api/status/dataPriority MEDIUM 45
- TI-2026-21952 Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_filesPriority MEDIUM 45
Show 1 more group
- Release ·
Pepperl+Fuchs ICE2-8IOL-G65L-V1D, ICE2-8IOL-K45P-RJ45 and 7 more products 1.7.4
20 records Highest priority Priority MEDIUM 13 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-21940 Authentication Bypass in _account_logPriority MEDIUM 51
- TI-2026-21953 Command Injection via GET in /api/status/dataPriority MEDIUM 45
- TI-2026-21952 Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_filesPriority MEDIUM 45
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27565
- 2026-10-03 Alias added: GHSA-9q7j-q2f8-2hh2
References
More Pepperl+Fuchs vulnerabilities
- TI-2017-03716 Observable discrepancy in Intel Most Modern Operating Systems CVSS 3.1MEDIUM 5.6
- TI-2020-10008 Pepper+Fuchs Comtrol IO-Link Master OS Command Injection CVSS 3.1HIGH 8.8
- TI-2020-09998 Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products CVSS 3.1HIGH 7.2
- TI-2026-21940 Authentication Bypass in _account_log CVSS 3.1CRITICAL 9.8
- TI-2020-09999 Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products CVSS 3.1CRITICAL 9.8
- TI-2020-09996 Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-27565 · CVE Program
- CVE-2026-27565 · NVD
- FIRST EPSS
- GHSA-9q7j-q2f8-2hh2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences