This vulnerability (CWE-98) involves improper control of filenames in an include/require statement in PHP, specifically in the Pepperl+Fuchs ICE2-8IOL1-G65L-V1D product. An attacker with low privileges and a valid operator cookie can exploit a local file inclusion vulnerability at the /index.php/ajax/save_iodd_parameters endpoint to execute arbitrary PHP code remotely on the device. The CVSS 3.1 score is 8.8, indicating high impact with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows remote code execution with the privileges of the operator user, potentially leading to full system compromise, data theft, or disruption of device functionality. Confidentiality, integrity, and availability impacts are all rated high.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and ensure operator credentials are tightly controlled to mitigate exploitation risk.