EUVD-2026-77241
GHSA-j5cc-m29c-rhm8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover CPSL-08P1EN on network
-
DeliverySend request to unauthenticated critical endpoint
-
ExploitBypass authentication gate
-
ExecutionIssue device control commands
-
ImpactDisrupt or reconfigure industrial device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CPSL-08P1EN management interface must be reachable over a network (LAN or Internet). The critical function exposed without authentication is not further specified in available data - the exact endpoint, protocol (HTTP/Telnet/proprietary), or interface is not named in the description or references. The CVSS 4.0 vector indicates PR:L (low privileges required), which conflicts with the description's 'without authentication' language; if PR:L is authoritative, some minimal credential or session context may still be needed to reach the vulnerable function, which would limit exploitation compared to a fully unauthenticated path. Exploitation is limited to devices whose management plane is network-accessible; devices isolated to a management VLAN with no external exposure are not directly reachable by remote attackers. |
| Impact | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7, reflecting high impact across confidentiality, integrity, and availability. However, there is a notable conflict between the CVSS 4.0 PR:L metric (low privileges required) and the description's explicit statement that a 'remote attacker without authentication' can exploit this - which maps semantically to PR:N (no privileges). This discrepancy should be verified against the Contec advisory PDF. If PR:N is accurate, real-world exploitability is higher than the 8.7 score implies. No CISA KEV listing and no public POC are known, and EPSS data is not provided. The industrial niche of the product limits mass exploitation potential, but any Internet-exposed or insufficiently segmented CPSL-08P1EN unit in an OT/industrial environment represents a serious risk given full device control is the impact. |
| Exploit ScenarioDerived | An attacker scans for CPSL-08P1EN devices reachable over the network, then sends a crafted HTTP or protocol-level request directly to the unauthenticated critical function endpoint, bypassing any login requirement. With no credentials or prior access needed, the attacker gains the ability to operate or reconfigure the device - potentially disrupting industrial communications, altering switch/relay states, or extracting device configuration data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 14, 2026
Missing authentication on a critical function in the Contec CPSL-08P1EN allows a network-reachable attacker to operate the device without supplying credentials. The flaw (CWE-306) means a protected management or control function is reachable directly over the network with no authentication gate, giving an adversary the same effective access as a legitimate administrator. No public exploit or CISA KEV listing exists at time of analysis, but the straightforward exploitation path (no complexity, no user interaction) lowers the bar for opportunistic targeting of Internet-exposed or weakly-segmented devices.
RemediationAI
Consult the vendor advisory published by Contec Co., Ltd. (https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_cps_26091000_en.pdf) and the JVN advisory at https://jvn.jp/en/vu/JVNVU96551518/ for patch availability and exact fixed firmware versions; no specific patched version is independently confirmed in the available data. As an immediate compensating control, isolate CPSL-08P1EN devices behind a firewall or network segmentation boundary so their management interface is not reachable from untrusted networks - this directly eliminates the AV:N attack path. If remote management is operationally required, restrict access to the device's management port to specific trusted IP ranges via ACLs. Do not expose this device directly to the Internet until a vendor-confirmed patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-306 (Missing Authentication for Critical Function) describes a design flaw where a function that performs sensitive operations - configuration changes, firmware control, device restart, or similar - is exposed without requiring any identity verification prior to invocation. The affected product, Contec CPSL-08P1EN (CPE: cpe:2.3:a:contec_co.,_ltd.:cpsl-08p1en:*:*:*:*:*:*:*:*), is an industrial network device manufactured by Contec Co., Ltd., a Japanese industrial automation company. JPCERT/CC coordinates its disclosure via JVN (JVNVU96551518), consistent with the product's Japanese market origin. The vulnerability is in the application layer of the device's management interface and is network-accessible per the AV:N designation in the provided CVSS 4.0 vector.
Know when Cpsl 08P1En gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description explicitly states exploitation without authentication (PR:N); full device control implies C:H/I:H/A:H; scope unchanged as impact remains on the device itself.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
4DescriptionCVE.org
Missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a remote attacker without authentication.
Executive ViewAI
The Contec CPSL-08P1EN is vulnerable to unauthenticated remote administrative access (CVE-2026-82787), allowing any network-connected attacker to fully control the device without credentials or user interaction. This represents immediate operational risk for organizations where these devices manage critical infrastructure or processes. With no vendor patch available, remediation requires urgent network segmentation or device replacement.
No vendor-released patch identified at time of analysis. Implement network segmentation: restrict device access via firewall to authorized administrator networks only; deploy on isolated management VLAN segregated from production systems; enable comprehensive network logging and intrusion detection for unauthorized connection attempts; prioritize device replacement with authenticated alternatives if operationally feasible within 90 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB