This vulnerability (CVE-2026-27553) involves exposure of sensitive system information (user password hashes) due to improper handling of the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint of the Pepperl+Fuchs ICE2-8IOL1-G65L-V1D product. A remote attacker with low privileges and a valid user cookie can exploit this flaw to disclose password hashes. The issue is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The affected versions are >=1.0.0 and <1.7.4. No known exploits are reported in the wild, and no patch links are provided in the source data.

An attacker with low privileges and a valid user cookie can disclose all user password hashes, potentially leading to credential compromise if hashes are cracked. The vulnerability does not impact integrity or availability but has high confidentiality impact. The CVSS 3.1 base score is 6.5 (medium severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the affected endpoint and ensure that user cookies are protected to reduce risk.