EUVD-2026-77248
GHSA-3vqr-mgc9-pjp4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
FTP is network-reachable, traversal is low complexity, but PR:L is required for FTP credentials; no availability impact stated.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
4DescriptionCVE.org
Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or altered by an attacker who can access the product via FTP.
AnalysisAI
Path traversal via FTP in Contec FX5000, FX4000, and FX3000 series industrial programmable controllers allows an authenticated FTP user to read or modify arbitrary files on the device filesystem. The affected products span a broad range of industrial OT endpoints including Ethernet, serial, and wireless variants. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires low-privilege FTP access to the affected controller - specifically, valid FTP credentials for the device's embedded FTP service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) reflects a network-reachable, low-complexity attack requiring only low-privilege FTP credentials - consistent with the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released firmware update per the Contec security advisory (contec_security_fl_26091000_en.pdf). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable FTP on all affected Contec FX3000, FX4000, and FX5000 controllers, or immediately restrict FTP access exclusively to trusted administrative networks via firewall rules; simultaneously conduct a complete inventory of deployed Contec FX series devices to identify which systems have FTP exposure or internet/untrusted-network connectivity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command injection in Contec FX5000, FX4000, and FX3000 series industrial data loggers and remote I/O units allows aut
Cross-site request forgery affects a broad range of Contec industrial data loggers, flow computers, and remote I/O coupl
Cross-site scripting in Contec FX5000, FX4000, and FX3000 series industrial data loggers allows a low-privileged authent
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today