An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot.

CVE-2026-27565 describes a critical vulnerability allowing an unauthenticated remote attacker to upload a malicious IODD file to a vulnerable device. The uploaded file places and executes a shell script with root privileges, granting full system control. The persistence mechanism ensures the malicious shell script survives reboots, making remediation more complex. No authentication is required to exploit this vulnerability, significantly lowering the barrier for attackers. The vulnerability affects industrial or IoT devices that support IODD file uploads. Multiple advisories have been published by CERT VDE covering related devices and vendors. The impact is rated High given the combination of unauthenticated access, root-level code execution, and persistent compromise. Organizations using affected devices should apply patches or mitigations immediately and audit for signs of exploitation.