This vulnerability (CWE-863) involves improper authorization checks in the /index.php/attached_devices_tab/do_upload endpoint of the Pepperl+Fuchs ICE2-8IOL1-G65L-V1D device. An attacker with low privileges can remotely upload IODD files, potentially modifying device behavior or causing denial of service via system crashes. The issue affects versions >=1.0.0 and <1.7.4. The CVSS 3.1 score of 8.1 indicates high impact with network attack vector, low attack complexity, requiring low privileges and no user interaction, causing high impact on integrity and availability. No vendor advisory or patch information is available, and no known active exploitation has been reported.

Successful exploitation allows a low-privileged remote attacker to upload files that can alter device behavior or cause system crashes, impacting device integrity and availability. Confidentiality is not affected. This can lead to denial of service or unauthorized modification of device functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected endpoint and monitor for unauthorized upload attempts. Apply principle of least privilege to limit attacker capabilities.