Executive brief
Pepperl+Fuchs ICE2 and ICE3 industrial Ethernet couplers contain multiple command injection vulnerabilities in their web-based management interface. A low-privileged attacker with valid credentials can execute arbitrary commands with root privileges, allowing complete device compromise including data theft, device manipulation, and persistence across reboots.
Technical details
The vulnerability is a classic OS command injection (CWE-78) in the /api/status/data endpoint and multiple other PHP-based endpoints (_account_log, various /index.php/ajax/* paths) within the device's web interface. The vulnerable component fails to properly neutralize user-supplied input before passing it to shell command execution. Exploitation requires valid user or operator credentials and network access to the management interface. An authenticated attacker can inject shell metacharacters to execute arbitrary code with root privileges. The advisory confirms multiple variants across different endpoints (CVE-2026-27547 through CVE-2026-27551, CVE-2026-27554) with consistent CVSS 8.8 scores. Patches addressing these issues are available in firmware version 1.7.4 and later.
Affected products
- Pepperl+Fuchs ICE2-8IOL-G65L-V1D <1.7.4
- Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 <1.7.4
- Pepperl+Fuchs ICE2-8IOL-K45S-RJ45 <1.7.4
- Pepperl+Fuchs ICE2-8IOL1-G65L-V1D <1.7.4
- Pepperl+Fuchs ICE3-8IOL-G65L-V1D <1.7.4
- Pepperl+Fuchs ICE3-8IOL-G65L-V1D-Y <1.7.4
- Pepperl+Fuchs ICE3-8IOL-K45P-RJ45 <1.7.4
- Pepperl+Fuchs ICE3-8IOL-K45S-RJ45 <1.7.4
- Pepperl+Fuchs ICE3-8IOL1-G65L-V1D <1.7.4
Timeline
- 2026-09-16: disclosed