Phoenix Contact: Multiple vulnerabilities in the firmware of IOL MA8 EIP DI8 and IOL MA8 PN DI8 devices
Plan PatchCVSS 9.8VDE-2026-027Sep 16, 2026
Phoenix Contact
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
The firmware of IOL MA8 EIP DI8 and IOL MA8 PN DI8 digital input modules contains multiple critical vulnerabilities: authentication bypass, command injection, local file inclusion, and path traversal. These flaws allow attackers to execute arbitrary code on the devices and extract sensitive information including password hashes and private keys.
What this means
What could happen
An attacker with network access to the webserver could bypass authentication and execute arbitrary commands on the I/O module, potentially altering its input readings or blocking legitimate operations. They could also extract configuration files containing credentials used for engineering access or inter-system communications.
Who's at risk
This affects water and electrical utilities using Phoenix Contact IOL MA8 EIP DI8 and IOL MA8 PN DI8 digital input modules in PROFINET or EtherCAT networks for process monitoring or equipment feedback. Any facility relying on these I/O modules for critical measurements, alarms, or control logic is at risk.
How it could be exploited
An attacker sends a crafted HTTP request to the device's webserver exploiting the authentication bypass to gain access, then uses command injection or file inclusion to execute code or retrieve sensitive files. No valid credentials are required; the device is vulnerable immediately upon network reachability.
Prerequisites
- Network access to the device's HTTP/webserver port
- No authentication credentials required
remotely exploitableno authentication requiredlow complexityhigh CVSS (9.8)affects I/O and control logic
Exploitability
Some exploitation risk — EPSS score 2.9%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
IOL MA8 PN DI8≥ 1.0.0, < 1.7.41.7.8
IOL MA8 EIP DI8≥ 1.0.0, < 1.7.41.7.8
Remediation & Mitigation
0/4
Do now
0/2WORKAROUNDDisable the webserver on affected devices if not required for operations
HARDENINGRestrict firewall access to the IOL MA8 devices to authorized engineering networks only; block HTTP/HTTPS from untrusted subnets
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
IOL MA8 PN DI8
HOTFIXUpdate IOL MA8 PN DI8 firmware to version 1.7.8 or later
IOL MA8 EIP DI8
HOTFIXUpdate IOL MA8 EIP DI8 firmware to version 1.7.8 or later
CVEs (20)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/e252c802-80f2-4730-a648-809726827074Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.