Loading vulnerability…
Persistent Root Command Injection via IODD Upload in IO-Link Masters
CVE-2026-27565 is an OS command-injection vulnerability in IODD file processing in affected IO-Link industrial master devices from Pepperl+Fuchs, Phoenix Contact, and Carlo Gavazzi running firmware versions earlier than 1.7.4. An unauthenticated remote attacker can upload a crafted IODD file containing shell commands. The commands cause a shell script to be written and executed with root privileges; the script is retained across device reboots, establishing persistent compromise.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation provides unauthenticated remote root-level code execution on the affected industrial device. An attacker can compromise confidentiality, integrity, and availability, alter device behavior or configuration, deploy persistent payloads, and retain execution after reboot or power cycling.
If you can’t patch tonight, do this now.
Until firmware 1.7.4 is deployed, restrict management-interface access to trusted OT administration networks and restrict or disable IODD upload functionality. Review potentially exposed devices for unexpected persistent shell scripts, unfamiliar processes, and anomalous outbound connections. Reflash devices where upload of untrusted IODD files cannot be excluded.
Patch, then assume compromise.
Upgrade affected devices to firmware version 1.7.4, which remediates CVE-2026-27565.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.