Which versions of CONPROSYS TM Series are affected by CVE-2026-82780?

CONTEC CONPROSYS TM Series industrial controllers (CPS-TM341 models) allow authenticated remote attackers to execute arbitrary commands through malicious file uploads, enabling complete control…. A patch is available.

How to fix or mitigate CVE-2026-82780?

Within 24 hours, restrict all management interface access to these CPS-TM341 controllers to explicit IP whitelists and mandate VPN-based connectivity for remote administration; disable the file upload feature if operationally possible. Within 7 days, enable multi-factor authentication on all administrative accounts, conduct forensic review of recent upload logs for suspicious activity, and implement file type restrictions to prevent executable uploads. Within 30 days, coordinate directly with CONTEC to confirm patch availability timeline and evaluate firmware updates or workarounds; assess feasibility of replacing affected CPS-TM341G5MB-ADSC1-931, CPS-TM341MB-ADSC1-931, and CPS-TM341GMB-ADSC1-931 devices with patched alternatives or control system redundancy.

CONPROSYS TM Series CVE-2026-82780

Q: What is the CVSS score of CVE-2026-82780?

CVE-2026-82780 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-77233 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-09-14 jpcert

GHSA-5m6w-fc43-6xv8

File Upload Cps Tm341G5Mb Adsc1 931 Cps Tm341Mb Adsc1 931 Cps Tm341Gmb Adsc1 931

8.7

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable upload endpoint requires only low-privilege auth; no scope change as subsequent-system impact is not described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 14, 2026 - 08:01 EUVD

Analysis Generated

Sep 14, 2026 - 07:27 vuln.today

CVSS changed

Sep 14, 2026 - 07:22 NVD

8.8 (HIGH) 8.7 (HIGH)

CVE Published

Sep 14, 2026 - 06:41 cve.org

HIGH 8.7

DescriptionCVE.org

Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series. If a specially crafted file is uploaded by a remote authenticated attacker, an arbitrary command may be executed on the product.

AnalysisAI

Arbitrary command execution via unrestricted file upload affects CONTEC's CONPROSYS TM Series industrial controllers (CPS-TM341G5MB-ADSC1-931, CPS-TM341MB-ADSC1-931, and CPS-TM341GMB-ADSC1-931). A remote attacker holding valid credentials can upload a specially crafted file through the device's management interface, causing the underlying system to execute attacker-controlled commands. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated session on the CONPROSYS TM Series device management interface, as indicated by PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately captures the core risk profile: network-reachable, low complexity, no special attack prerequisites, and full system-level impact upon success. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Consult CONTEC's official security advisory (contec_security_cps_26091000_en.pdf linked via the vendor site) and the JPCERT/CC notice at JVNVU96551518 for the specific patched firmware version; an exact fix version number is not independently confirmed from the available reference data, so operators should contact CONTEC directly to obtain the remediated firmware. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, restrict all management interface access to these CPS-TM341 controllers to explicit IP whitelists and mandate VPN-based connectivity for remote administration; disable the file upload feature if operationally possible. …

Threat intelligence, references, and detailed analysis are available after sign-in.