19 Pepperl+Fuchs IO-Link Master Flaws Expose Root Access in OT

Detail

The IO-Link Master is a classic "invisible asset", often unpatched, rarely inventoried, and assumed benign because it is not a PLC. That assumption is now the industry's biggest blind spot. Attackers are following data, and data lives at the edge.

and uncovered a chain of flaws spanning authentication bypass, OS command injection, path traversal, local file inclusion, incorrect authorization, and information disclosure.

function means the login mechanism never validates usernames against the stored credential database, so a crafted username grants an Admin session whether or not passwords are configured. No credentials required.

Affected: ICE2/ICE3 IO-Link Master series (also sold under Phoenix Contact and Carlo Gavazzi Automation brands). Affected firmware builds observed in EtherNet/IP 1.7.x family.

. The authentication bypass and unauthenticated path traversal let any host that can reach the web management interface obtain an Admin session or steal the SSH server's private keys, without credentials.

With keys in hand, attackers impersonate the device's SSH server to harvest credentials from maintenance engineers, then weaponize OS command injection flaws to root the device. From there, the compromised master becomes a bridgehead.

Stolen SSH keys are the quiet multiplier here. By impersonating a trusted maintenance interface, attackers convert a single vulnerable node into a credential-harvesting trap for the engineers who keep plants running, turning routine service calls into a supply chain of its own.