A critical command injection vulnerability in Pepperl+Fuchs IO-Link Master modules allows low-privileged authenticated users to gain full root control over the affected devices.

This is an OS command injection flaw (CWE-78) located in the /index.php/ajax/save_iodd_parameters endpoint. The vulnerability can be triggered by any authenticated operator, allowing the execution of system commands with root privileges.

Successful exploitation of this vulnerability grants an attacker complete control over the industrial communication device. Because the commands execute with root privileges, the attacker could potentially pivot into the broader industrial control network, exfiltrate sensitive configuration data, or disrupt critical manufacturing processes. With a CVSS score of 8.8, this vulnerability represents a high risk to operational continuity and system integrity.

Immediate Action: Update all affected Pepperl+Fuchs IO-Link Master modules to firmware version 1.7.4 or later as specified in the vendor advisory.

Proactive Monitoring: Review device access logs for suspicious activity involving the /index.php/ajax/save_iodd_parameters endpoint and monitor for unexpected process execution originating from the web interface.

Compensating Controls: Restrict network access to the device management interface to trusted administrative subnets only, and implement strict account management policies to limit the number of users with operator-level access.

Public Exploit Available: Unknown

The ability for a low-privileged user to escalate to root access on an industrial device is a severe security failure that necessitates immediate attention. Organizations utilizing Pepperl+Fuchs ICE2 and ICE3 series modules must prioritize the deployment of firmware version 1.7.4 to eliminate this command injection vector. Failure to patch these devices leaves critical infrastructure vulnerable to unauthorized control and potential operational sabotage.