This vulnerability (CVE-2026-27551) is an OS command injection (CWE-78) in the Pepperl+Fuchs ICE2-8IOL1-G65L-V1D product. It allows an attacker with low privileges and valid user credentials to execute arbitrary commands as root through the /index.php/ajax/parameterManage endpoint. The affected versions are >=1.0.0 and <1.7.4. The CVSS 3.1 score is 8.8, indicating high impact on confidentiality, integrity, and availability. No patch links or vendor advisories are provided, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with low-privileged user credentials to execute arbitrary commands with root privileges on the device, potentially leading to full system compromise, data loss, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and ensure that only trusted users have credentials. Monitor for unusual activity related to the /index.php/ajax/parameterManage endpoint.