A critical authentication bypass in Pepperl+Fuchs IO-Link Master devices allows unauthenticated remote attackers to achieve full administrative control over the hardware.

The flaw exists within the _account_log function, which fails to correctly validate user credentials. An unauthenticated remote attacker can leverage this alternate path to bypass authentication and log in with administrative privileges.

Successful exploitation of this vulnerability results in a total compromise of the affected IO-Link Master devices. Given the CVSS score of 9.8, the risk is critical, as attackers can alter operational configurations, intercept industrial process data, or disable safety-critical monitoring, leading to significant operational downtime and potential physical process interference.

Immediate Action: Update all affected Pepperl+Fuchs IO-Link Master devices to firmware version 1.7.4 or later immediately.

Proactive Monitoring: Review device access logs for unauthorized administrative login events or anomalous patterns originating from unknown or external network segments.

Compensating Controls: Isolate industrial control devices from the public internet and restrict management access to authorized internal networks via firewall rules to minimize exposure.

Public Exploit Available: No

The severity of this vulnerability, combined with its ease of exploitation from a remote, unauthenticated state, necessitates immediate action. Security teams must prioritize the deployment of the 1.7.4 firmware update across all identified infrastructure to prevent unauthorized administrative access and maintain the integrity of industrial control operations.