CVE-2026-27546

Authentication Bypass in _account_log

State: Published
Severity: 9.8 Critical
Published: Sep 16, 2026
Updated: Sep 16, 2026
Reserved: Feb 20, 2026

Description

An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-288 Authentication Bypass Using an Alternate Path or Channel

Affected Products

Product	Versions
ICE2-8IOL1-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE2-8IOL-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE2-8IOL-K45P-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE2-8IOL-K45S-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL1-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-G65L-V1DPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-G65L-V1D-YPepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-K45P-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
ICE3-8IOL-K45S-RJ45Pepperl+Fuchs	1.0.0 to before 1.7.4Affected
IOL MA8 PN DI8Phoenix Contact	1.0.0 to before 1.7.4Affected
IOL MA8 EIP DI8Phoenix Contact	1.0.0 to before 1.7.4Affected
YL212CEI8M1IOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected
YN115CEI8RPIOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected
YL212CPN8M1IOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected
YN115CPN8RPIOCarlo Gavazzi Automation	1.0.0 to before 1.7.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.