Critical flaws let attackers seize industrial controllers from three vendors

Researchers have identified multiple vulnerabilities in shared industrial controller firmware used by Pepperl+Fuchs, Phoenix Contact and Carlo Gavazzi Automation. The affected products include Pepperl+Fuchs ICE2 and ICE3 network modules, Phoenix Contact IOL MA8 PN DI8 and IOL MA8 EIP DI8 devices, and Carlo Gavazzi YL212 and YN115 series controllers. Firmware releases before version 1.7.4 are affected.

The article lists three CVEs: CVE-2026-27565 and CVE-2026-27546, both rated 9.8 (Critical), and CVE-2026-27557, rated 7.5 (High). No exploitation in the wild has been confirmed.

CVE-2026-27546 enables authentication bypass, while CVE-2026-27565 permits an unauthenticated attacker to upload a malicious IODD file and execute a shell script with root privileges. The article also describes path traversal in CVE-2026-27557, which can expose private SSH keys, along with additional command-injection and local-file-inclusion flaws. Researchers Gabriele Quagliarella and Luca Borzacchiello of Nozomi Networks reported the vulnerabilities. The vendors’ advisories warn that attackers could bypass authentication and execute code with high privileges on affected devices.

The article says firmware version 1.7.8 is available and should be installed immediately, although its vulnerability table identifies version 1.7.4 as the fix for the three listed CVEs. Where updating is not immediately possible, operators should isolate affected equipment, minimise network exposure, ensure devices are not reachable from the internet and limit remote access to secure VPNs.