EUVD-2026-77222
GHSA-49qp-2349-c55w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
FTP service is network-reachable with low complexity; PR:L reflects required FTP authentication; high C and I for arbitrary file read/write; A:N as no availability impact is described.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
4DescriptionCVE.org
Path traversal vulnerability exists in SGA1000. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or altered by an attacker who can access the product via FTP.
AnalysisAI
Path traversal in Contec SGA1000 allows a network attacker with FTP credentials to read and overwrite arbitrary files on the device filesystem. Reported by JPCERT and documented in JVN advisory JVNVU99009004, the flaw affects all known SGA1000 versions and exposes sensitive server-side files - including configuration, credentials, and system data - to unauthorized disclosure and modification via crafted FTP path arguments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) network reachability to the SGA1000 FTP service - if FTP is restricted to a management VLAN or blocked at the perimeter, remote attackers cannot reach it; (2) valid FTP credentials with at least low-privilege access, as reflected by PR:L in the CVSS 4.0 vector - unauthenticated exploitation is not supported by the available data; (3) the FTP service must be enabled and actively running on the device. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N accurately captures the dual read/write filesystem impact, and the PR:L metric correctly reflects the FTP authentication barrier that partially limits exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the firmware or software update described in the Contec security advisory at https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_fl_26091000_en.pdf and the JVN advisory at https://jvn.jp/en/vu/JVNVU99009004/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all SGA1000 devices in your environment and assess which have FTP enabled, particularly those reachable from external networks; implement immediate network-level access controls restricting FTP to authorized administrative sources only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command injection in Contec's SGA1000 device allows an authenticated network attacker to execute arbitrary commands o
Cross-site request forgery affects a broad range of Contec industrial data loggers, flow computers, and remote I/O coupl
Cross-site scripting (XSS) in the Contec SGA1000 web management interface allows an adjacent-network attacker to inject
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today