The vulnerability allows a low‑privileged remote attacker to inject a local file path through the /index.php/ajax/get_iodd_port_info endpoint. By providing a valid user cookie, the attacker can cause PHP to include an arbitrary file, leading to execution of arbitrary PHP code on the device. The weakness is a classic local file inclusion flaw (CWE-98) and can compromise confidentiality, integrity, and availability of the affected device if exploited.

Manufacturers Carlo Gavazzi Automation and Pepperl+Fuchs provide impacted firmware for several industrial controllers, including models YL212CEI8M1IO, YL212CPN8M1IO, YN115CEI8RPIO, YN115CPN8RPIO, ICE2‑8IOL‑G65L‑V1D, ICE2‑8IOL‑K45P‑RJ45, ICE2‑8IOL‑K45S‑RJ45, ICE2‑8IOL1‑G65L‑V1D, ICE3‑8IOL‑G65L‑V1D, ICE3‑8IOL‑G65L‑V1D‑Y, ICE3‑8IOL‑K45P‑RJ45, ICE3‑8IOL‑K45S‑RJ45, ICE3‑8IOL1‑G65L‑V1D, IOL MA8 EIP DI8, and IOL MA8 PN DI8. The specific firmware versions are not listed in the advisory, so any firmware built on the mentioned platforms is potentially affected.

The CVSS score of 8.8 indicates a high severity vulnerability that can lead to complete compromise of the device through code execution. The EPSS score of less than 1% shows a low probability of exploitation at present, and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting it has not yet been exploited in the wild. However, given that a valid user cookie suffices, the attack surface is sufficient to target hostile actors without needing privileged credentials. The likely attack vector is remote over a network connected to the device, where an attacker can craft a request to the exposed endpoint while supplying an authenticated session cookie. Because the flaw involves file inclusion, exploitation requires the attacker to identify or guess the path of the target file, which narrows the success window but still leaves realistic risk for automated scanning or directed attacks.