Loading story…
CERT@VDE disclosed two CVSS 9.8 vulnerabilities in 15 IO-Link industrial master models from Pepperl+Fuchs, Phoenix Contact, and Carlo Gavazzi Automation. CVE-2026-27546 is an authentication-bypass flaw in the _account_log function that can grant an unauthenticated attacker an administrator session, while CVE-2026-27565 is an IODD-file processing command-injection flaw that enables unauthenticated root-level command execution and can persist a malicious script on the device.
Affected products include Pepperl+Fuchs ICE2 and ICE3 series devices, Phoenix Contact IOL MA8 EIP DI8 and IOL MA8 PN DI8 models, and Carlo Gavazzi YL212 and YN115 models running firmware earlier than 1.7.4. The Canadian Centre for Cyber Security advises organizations to apply firmware 1.7.4 and follow vendor guidance; administrators should isolate management interfaces and restrict IODD uploads until remediation is complete. No public exploit or CISA Known Exploited Vulnerabilities catalog listing was reported at disclosure.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-927 identifying multiple security vulnerabilities affecting specified Pepperl+Fuchs ICE2 and ICE3, Phoenix Contact IOL MA8, and Carlo Gavazzi YL212 and YN115 industrial I/O devices. The advisory directed users to consult vendor advisories and apply necessary firmware updates; affected versions are earlier than 1.7.4.
CERT@VDE published advisory VDE-2026-027 disclosing CVE-2026-27546, an authentication-bypass flaw, and CVE-2026-27565, an OS command-injection flaw, affecting 15 IO-Link industrial master models from Pepperl+Fuchs, Phoenix Contact, and Carlo Gavazzi. Both primary vulnerabilities were rated CVSS 9.8; affected devices running firmware earlier than 1.7.4 should be upgraded to version 1.7.4.
CERT@VDE reported that Phoenix Contact IOL MA8 EIP DI8 and IOL MA8 PN DI8 firmware is vulnerable to authentication bypass, command injection, local file inclusion, path traversal, and modified-schema attacks. The flaws can enable code execution and disclosure of sensitive information, including password hashes and private keys.
CERT@VDE reported that Carlo Gavazzi YL212 and YN115 devices have authentication-bypass, command-injection, local-file-inclusion, path-traversal, and modified-schema vulnerabilities. The flaws could enable code execution or exposure of sensitive data, including password hashes and private keys.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcethreataft.com
Open sourcecertvde.com
Open sourcecertvde.com
Open sourcecertvde.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rockwell Automation, Siemens, and Schneider Electric issued July industrial security advisories covering dozens of OT vulnerabilities, with Rockwell disclosing multiple high-impact flaws in control and I/O products. The most severe Rockwell issue, **CVE-2026-10577**, affects `1715 Redundant IO` and exposes a network-accessible debug port without authentication, allowing remote attackers to run intrusive CLI commands, read or delete files, stop tasks, modify memory, and change I/O states; the flaw carries a **CVSS v4.0 score of 10.0**. Rockwell also reported **CVE-2026-9636**, a CIP Security certificate revocation handling weakness in several `CompactLogix 5380`, `ControlLogix 5580`, `GuardLogix 5580`, and `1756-EN4` devices that could let a network attacker connect with a certificate that should no longer be trusted, and **CVE-2025-11698**, a buffer overflow in Logix controller recovery images that can trigger a major non-recoverable fault and cause denial of service. Separately, CERT VDE published **VDE-2026-031** for **CVE-2026-4769**, a critical **WAGO System I/O Field** vulnerability caused by an undocumented internal diagnostic function exposed without authentication during early boot. An unauthenticated remote attacker can exploit the startup window to access internal system processes and fully compromise affected `0765-series` devices; the issue is rated **CVSS 3.1 9.8** and **CVSS 4.0 9.3**. Siemens also disclosed **CVE-2025-40945**, an untrusted search path flaw in the IAM Client SDK used across products including `COMOS`, `Designcenter NX`, `Simcenter`, `Solid Edge`, `Teamcenter Visualization`, and `Tecnomatix`, enabling local privilege escalation for authenticated users and reinforcing the breadth of current patching demands across industrial environments.
Jul 17, 2026
Siemens RUGGEDCOM ROX industrial networking devices contain a **critical** OS command injection flaw, tracked as `CVE-2025-40949`, in the Scheduler function of the Web UI. The vulnerability stems from improper input validation in the task scheduling backend, allowing an authenticated remote attacker to inject arbitrary commands and execute them with **root privileges** on the underlying operating system. The issue carries a **CVSS v3.1 score of 9.1** and was reported by researchers at the Palo Alto Networks OT Threat Research Lab. Affected products include multiple Siemens RUGGEDCOM ROX lines, including **MX5000**, **MX5000RE**, **RX1400**, **RX1500-series**, **RX1536**, and **RX5000** devices running versions earlier than **2.17.1**. CISA republished Siemens ProductCERT guidance urging organizations to upgrade to fixed releases, restrict network exposure, and follow Siemens industrial security recommendations to reduce the risk of exploitation in operational technology environments.
Jun 29, 2026
**CISA** published an ICS advisory warning that **Johnson Controls Frick Controls Quantum HD** (versions **10.22 and earlier**) contains multiple vulnerabilities that can be exploited **before authentication**, enabling **remote code execution (RCE)**, **information leakage**, and potentially **denial of service** in environments where the product is deployed (noted as worldwide, including **Food and Agriculture** critical infrastructure). CISA lists a **CVSS v3.1 base score of 9.1 (Critical)** for the issue set and attributes the root cause across several items to **insufficient input validation** in device parameters. The disclosed CVEs include **CVE-2026-21654** (**OS command injection**, CWE-78) and several **code injection** RCE issues (**CVE-2026-21656**, **CVE-2026-21657**, **CVE-2026-21658**, **CWE-94**) that could allow unexpected actions and system compromise without credentials. **CVE-2026-21659** describes **local file inclusion (LFI)** (CWE-23) leading to **unauthenticated RCE and information disclosure**, explicitly stating an attacker could execute arbitrary code and achieve **full system compromise** on affected devices. The advisory also references an additional CVE (**CVE-2026-21660**) not detailed in the other provided entries, indicating the exposure spans more than the five CVE records included here.
Jun 29, 2026