CyberSecBulletin
CVE-2026-27546NVD status: Awaiting Analysis

ICE2-8IOL1-G65L-V1D: Authentication Bypass Using an Alternate Path or Channel

Published Updated By the CyberSecBulletin desk

CVE-2026-27546 is a critical-severity authentication bypass using an alternate path or channel vulnerability in ICE2-8IOL1-G65L-V1D from Pepperl+Fuchs, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 1.7.4 as the first without the flaw, so updating ICE2-8IOL1-G65L-V1D to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1.02% chance of exploitation within 30 days, higher than 64% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update ICE2-8IOL1-G65L-V1D to 1.7.4 or a later version.
  2. Update ICE2-8IOL-G65L-V1D to 1.7.4 or a later version.
  3. Update ICE2-8IOL-K45P-RJ45 to 1.7.4 or a later version.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Pepperl+FuchsICE2-8IOL1-G65L-V1D1.0.0 up to, but not including, 1.7.41.7.4
Pepperl+FuchsICE2-8IOL-G65L-V1D1.0.0 up to, but not including, 1.7.41.7.4
Pepperl+FuchsICE2-8IOL-K45P-RJ451.0.0 up to, but not including, 1.7.41.7.4
Pepperl+FuchsICE2-8IOL-K45S-RJ451.0.0 up to, but not including, 1.7.41.7.4
Pepperl+FuchsICE3-8IOL1-G65L-V1D1.0.0 up to, but not including, 1.7.41.7.4
Pepperl+FuchsICE3-8IOL-G65L-V1D1.0.0 up to, but not including, 1.7.41.7.4
Pepperl+FuchsICE3-8IOL-G65L-V1D-Y1.0.0 up to, but not including, 1.7.41.7.4
Pepperl+FuchsICE3-8IOL-K45P-RJ451.0.0 up to, but not including, 1.7.41.7.4
Pepperl+FuchsICE3-8IOL-K45S-RJ451.0.0 up to, but not including, 1.7.41.7.4
Phoenix ContactIOL MA8 PN DI81.0.0 up to, but not including, 1.7.41.7.4
Phoenix ContactIOL MA8 EIP DI81.0.0 up to, but not including, 1.7.41.7.4
Carlo Gavazzi AutomationYL212CEI8M1IO1.0.0 up to, but not including, 1.7.41.7.4
Carlo Gavazzi AutomationYN115CEI8RPIO1.0.0 up to, but not including, 1.7.41.7.4
Carlo Gavazzi AutomationYL212CPN8M1IO1.0.0 up to, but not including, 1.7.41.7.4
Carlo Gavazzi AutomationYN115CPN8RPIO1.0.0 up to, but not including, 1.7.41.7.4

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (cert.vde.com).

Official description

An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Authentication Bypass Using an Alternate Path or Channel

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

How developers prevent this class of flaw

  • Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

More Authentication Bypass Using an Alternate Path or Channel vulnerabilities (CWE-288)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).

References

Other vulnerabilities in ICE2-8IOL1-G65L-V1D

All ICE2-8IOL1-G65L-V1D vulnerabilities

Recent Authentication Bypass Using an Alternate Path or Channel vulnerabilities

Spotted an error? Tell us.