This vulnerability (CVE-2026-27557) involves a path traversal issue (CWE-35) in the Pepperl+Fuchs ICE2-8IOL1-G65L-V1D product. The flaw exists in the /index.php/view_uploaded_iodd_file endpoint, which allows an unauthenticated remote attacker to read sensitive files, specifically the SSH server's private keys. The affected versions are >=1.0.0 and <1.7.4. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. There is no vendor advisory or patch information available at this time.

An attacker exploiting this vulnerability can read the SSH server's private keys without authentication, potentially compromising secure communications and allowing unauthorized access to the device or network. The confidentiality impact is high, but integrity and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the affected endpoint and monitor for suspicious activity related to unauthorized file access attempts.