This vulnerability (CVE-2026-27548) involves improper neutralization of special elements in OS commands (CWE-78) in the Pepperl+Fuchs ICE2-8IOL1-G65L-V1D product. An attacker with low privileges and valid user or operator credentials can exploit the /index.php/ajax/get_iodd_port_info endpoint to perform OS command injection, resulting in execution of arbitrary commands with root privileges on the affected device. The flaw affects versions >=1.0.0 and <1.7.4. No known exploits in the wild have been reported. The CVSS v3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low-privileged user or operator credentials to execute arbitrary commands as root on the device, leading to full system compromise. This can result in complete loss of confidentiality, integrity, and availability of the affected device.

No patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and limit user/operator credentials to trusted personnel only.