EUVD-2026-77246
GHSA-vxg5-xqxv-m956
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible management interface, authenticated (PR:L per description), no scope change to other systems, full device impact.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
4DescriptionCVE.org
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
AnalysisAI
OS command injection in Contec's CAN-2-WF (Wireless LAN) and CAN-2-USB (USB) industrial communication converter units allows any authenticated user to execute arbitrary operating system commands on the device. The vulnerability, CWE-78, is reachable over the network with low privilege and no user interaction required, yielding full confidentiality, integrity, and availability impact on the affected unit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold valid login credentials to the CAN-2 device management interface (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 accurately captures the network-accessible, low-complexity attack with full device compromise potential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the firmware update or configuration guidance provided in Contec's official security advisory (https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_ph_26091000_en.pdf). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Contec CAN-2-WF and CAN-2-USB deployments across production and non-production networks; note affected firmware versions and disconnect from untrusted networks if operationally safe. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution is possible on Contec CAN 2.0B series communication converter units (CAN-2-WF wireless LAN and
Reflected or stored cross-site scripting in the web management interface of Contec's CAN-2-WF (Wireless LAN) and CAN-2-U
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today