Remote Code Execution Vulnerability in XYZ Product by ABC Vendor
CVE-2026-27565

9.8CRITICAL

Key Information:

Vendor

Pepperl+fuchs

Status
Ice2-8iol1-g65l-v1d
Ice2-8iol-g65l-v1d
Ice2-8iol-k45p-rj45
Ice2-8iol-k45s-rj45
Vendor
CVE Published:
16 September 2026

What is CVE-2026-27565?

An unauthenticated remote attacker can exploit a vulnerability in ABC Vendor's XYZ Product by uploading a malicious IODD file. This file can execute a shell script with root privileges, allowing unauthorized control over the system. Notably, the malicious script persists through system reboots, increasing the risk of prolonged exploitation.

Affected Version(s)

ICE2-8IOL-G65L-V1D 1.0.0 < 1.7.4

ICE2-8IOL-K45P-RJ45 1.0.0 < 1.7.4

ICE2-8IOL-K45S-RJ45 1.0.0 < 1.7.4

References

https://www.certvde.com/en/advisories/VDE-2026-014/
https://www.certvde.com/en/advisories/VDE-2026-027/
https://www.certvde.com/en/advisories/VDE-2026-028/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriele Quagliarella from Nozomi Networks
Luca Borzacchiello from Nozomi Networks
.