This vulnerability (CVE-2026-27555) is classified as CWE-98, improper control of filename for include/require statement, commonly known as a PHP Remote File Inclusion flaw. It allows a remote attacker with low privileges and a valid user cookie to exploit the /index.php/ajax/get_iodd_port_info endpoint to execute arbitrary PHP code on the Pepperl+Fuchs ICE2-8IOL1-G65L-V1D device. The affected versions are >=1.0.0 and <1.7.4. The vulnerability has a high CVSS score of 8.8, reflecting its potential impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low privileges to execute arbitrary PHP code remotely on the affected device, potentially leading to full compromise of the device. This impacts confidentiality, integrity, and availability of the system.

No patch or official fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and monitor for suspicious activity. Avoid exposing the device to untrusted networks.