This vulnerability (CVE-2026-27549) involves improper neutralization of special elements in OS commands (CWE-78) in the Pepperl+Fuchs ICE2-8IOL1-G65L-V1D product. Exploitation requires operator credentials and allows remote command execution with root privileges through the /index.php/attached_devices_tab/do_upload endpoint. Affected versions are >=1.0.0 and <1.7.4. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a low-privileged remote attacker with operator credentials to execute arbitrary commands as root on the affected device. This results in full system compromise, including complete loss of confidentiality, integrity, and availability of the device.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict operator credential access and monitor for suspicious activity related to the /index.php/attached_devices_tab/do_upload endpoint.