Which versions of CONPROSYS TM Series are affected by CVE-2026-82779?

Contec CONPROSYS TM Series industrial control devices (CPS-TM341 models) contain an authenticated OS command injection vulnerability allowing any logged-in user to execute arbitrary commands on the…. A patch is available.

How to fix or mitigate CVE-2026-82779?

Within 24 hours, identify all CPS-TM341 devices in your environment and restrict network access using firewall rules and segmentation; immediately rotate or disable any default accounts and document all users with device access. Within 7 days, implement multi-factor authentication for device access where feasible, audit credential management practices, and contact Contec to request patch status and timeline. Within 30 days, establish continuous monitoring for security updates from Contec and JVN; develop a remediation roadmap for critical systems that may include network isolation, air-gapping, or device replacement if patches remain unavailable beyond 90 days.

CONPROSYS TM Series CVE-2026-82779

Q: What is the CVSS score of CVE-2026-82779?

CVE-2026-82779 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

EUVD-2026-77232 HIGH

OS Command Injection (CWE-78)

2026-09-14 jpcert

GHSA-r687-5675-23w6

Command Injection Contec Cps Tm341G5Mb Adsc1 931 Cps Tm341Mb Adsc1 931 Cps Tm341Gmb Adsc1 931

8.7

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable management interface, low complexity injection once authenticated (PR:L); no scope change as subsequent systems are unaffected per CVSS 4.0 SC:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 14, 2026 - 08:01 EUVD

Metadata Corrected

Sep 14, 2026 - 07:40 vuln.today

tag: Contec added

Analysis Generated

Sep 14, 2026 - 07:27 vuln.today

CVSS changed

Sep 14, 2026 - 07:22 NVD

8.8 (HIGH) 8.7 (HIGH)

CVE Published

Sep 14, 2026 - 06:41 cve.org

HIGH 8.7

DescriptionCVE.org

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

AnalysisAI

Authenticated OS command injection in Contec CONPROSYS TM Series industrial devices allows any logged-in user to execute arbitrary operating system commands on the underlying host. Specifically, three CPS-TM341 model variants are confirmed affected per JVN advisory JVNVU96551518. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the attacker possess valid credentials to log in to the CONPROSYS TM Series device (PR:L per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 and accurately captures the attack profile: network reachable, low complexity, no special attack requirements, but requiring a valid login (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the firmware update or patch released by Contec per the official security advisory (https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_cps_26091000_en.pdf). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all CPS-TM341 devices in your environment and restrict network access using firewall rules and segmentation; immediately rotate or disable any default accounts and document all users with device access. …

Threat intelligence, references, and detailed analysis are available after sign-in.