Command Injection Vulnerability in Affected Product by Vendor
CVE-2026-27551

8.8HIGH

Key Information:

Vendor

Pepperl+fuchs

Status
Ice2-8iol1-g65l-v1d
Ice2-8iol-g65l-v1d
Ice2-8iol-k45p-rj45
Ice2-8iol-k45s-rj45
Vendor
CVE Published:
16 September 2026

What is CVE-2026-27551?

A command injection vulnerability exists in the /index.php/ajax/parameterManage endpoint, enabling low-privileged remote attackers to execute arbitrary commands. By leveraging user credentials, an attacker can gain unauthorized access and execute commands with root privileges on the targeted device, posing a significant threat to system integrity and confidentiality.

Affected Version(s)

ICE2-8IOL-G65L-V1D 1.0.0 < 1.7.4

ICE2-8IOL-K45P-RJ45 1.0.0 < 1.7.4

ICE2-8IOL-K45S-RJ45 1.0.0 < 1.7.4

References

https://www.certvde.com/en/advisories/VDE-2026-014/
https://www.certvde.com/en/advisories/VDE-2026-027/
https://www.certvde.com/en/advisories/VDE-2026-028/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriele Quagliarella from Nozomi Networks
Luca Borzacchiello from Nozomi Networks
.