Loading vulnerability…
Administrative Authentication Bypass in IO-Link Master _account_log
CVE-2026-27546 is an authentication-bypass vulnerability in the WebUI _account_log function of affected IO-Link industrial master devices. An unauthenticated remote attacker can submit crafted login input to obtain an Administrator-level session despite properly configured accounts, bypassing the intended Admin, Operator, and User role access-control model.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation grants unauthenticated remote administrative access to the affected device's administrative functions and associated data or configuration. The resulting Administrator session can enable unauthorized management of the device.
If you can’t patch tonight, do this now.
Until firmware is upgraded, limit management-interface access to trusted OT administration networks. Isolate WebUI and SSH management services on a restricted management VLAN, disable unneeded services, use unique passwords, and monitor for anomalous HTTP traffic.
Patch, then assume compromise.
Upgrade affected IO-Link industrial master devices to firmware version 1.7.4, which remediates CVE-2026-27546. Affected devices are those running firmware versions earlier than 1.7.4.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.