Critical Unauthenticated Root RCE Affects IO-Link Industrial Masters

CERT@VDE disclosed two CVSS 9.8 vulnerabilities in 15 IO-Link industrial master models from Pepperl+Fuchs, Phoenix Contact, and Carlo Gavazzi Automation. CVE-2026-27546 is an authentication-bypass flaw in the _account_log function that can grant an unauthenticated attacker an administrator session, while CVE-2026-27565 is an IODD-file processing command-injection flaw that enables unauthenticated root-level command execution and can persist a malicious script on the device.

Affected products include Pepperl+Fuchs ICE2 and ICE3 series devices, Phoenix Contact IOL MA8 EIP DI8 and IOL MA8 PN DI8 models, and Carlo Gavazzi YL212 and YN115 models running firmware earlier than 1.7.4. The Canadian Centre for Cyber Security advises organizations to apply firmware 1.7.4 and follow vendor guidance; administrators should isolate management interfaces and restrict IODD uploads until remediation is complete. No public exploit or CISA Known Exploited Vulnerabilities catalog listing was reported at disclosure.