Which versions of Contec CAN-2 are affected by CVE-2026-82793?

Contec CAN 2.0B series industrial communication converters (CAN-2-WF wireless and CAN-2-USB variants) are vulnerable to arbitrary code execution through unrestricted file upload on the device web…. A patch is available.

How to fix or mitigate CVE-2026-82793?

Within 24 hours: Inventory all Contec CAN 2.0B devices across your organization and document current firmware versions and network locations. Immediately audit high-privilege credential holders who have access to device web interfaces. Within 7 days: Implement network segmentation to isolate these devices from general corporate networks where feasible; enforce multi-factor authentication for administrative access to device management interfaces; disable file upload functionality on the device web interface if operational requirements permit. Within 30 days: Monitor Contec's advisory page and JPCERT/CC for patch releases; conduct risk assessment to prioritize affected devices by criticality; evaluate long-term remediation through firmware upgrade or equipment replacement; establish interim monitoring for suspicious file upload attempts in device logs.

Contec CAN-2 CVE-2026-82793

Q: What is the CVSS score of CVE-2026-82793?

CVE-2026-82793 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-77249 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-09-14 jpcert

GHSA-463x-vp7x-ppgq

RCE File Upload Can 2 Wf Can 2 Usb

8.6

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable upload, low complexity, but PR:H required per CVSS 4.0 source; full C/I/A on device, scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 14, 2026 - 08:01 EUVD

Analysis Generated

Sep 14, 2026 - 07:25 vuln.today

CVSS changed

Sep 14, 2026 - 07:22 NVD

7.2 (HIGH) 8.6 (HIGH)

CVE Published

Sep 14, 2026 - 06:45 cve.org

HIGH 8.6

DescriptionCVE.org

Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on the product.

AnalysisAI

Arbitrary code execution is possible on Contec CAN 2.0B series communication converter units (CAN-2-WF wireless LAN and CAN-2-USB USB variants) via unrestricted file upload. A remote attacker holding high-privilege credentials can upload a specially crafted file to the device's web interface, resulting in code execution directly on the embedded unit. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires remote network access to the device management web interface AND authentication with high-privilege (administrator-level) credentials (PR:H per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 base score of 8.6 with vector AV:N/AC:L/AT:N/PR:H/UI:N reflects network-reachable exploitation with no complexity or interaction requirements, but critically gated by PR:H (high privilege). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Consult the Contec vendor security advisory (contec_security_ph_26091000_en.pdf linked above) and the JPCERT/CC advisory JVNVU90314828 for the specific patched firmware version and update procedure; apply any available firmware update immediately. … Detailed patch versions, workarounds, and compensating controls in full report.