Can 2 Wf
Monthly
Arbitrary code execution is possible on Contec CAN 2.0B series communication converter units (CAN-2-WF wireless LAN and CAN-2-USB USB variants) via unrestricted file upload. A remote attacker holding high-privilege credentials can upload a specially crafted file to the device's web interface, resulting in code execution directly on the embedded unit. Reported by JPCERT/CC with a vendor advisory; no public exploit or CISA KEV listing identified at time of analysis.
OS command injection in Contec's CAN-2-WF (Wireless LAN) and CAN-2-USB (USB) industrial communication converter units allows any authenticated user to execute arbitrary operating system commands on the device. The vulnerability, CWE-78, is reachable over the network with low privilege and no user interaction required, yielding full confidentiality, integrity, and availability impact on the affected unit. Reported by JPCERT/CC with a vendor advisory published; no public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis.
Reflected or stored cross-site scripting in the web management interface of Contec's CAN-2-WF (Wireless LAN) and CAN-2-USB (USB Converter) industrial serial communication units allows an adjacent-network attacker to inject and execute arbitrary JavaScript in the browser of an authenticated user who interacts with the crafted content. The vulnerability affects the embedded web UI exposed by these serial-to-network converter devices, which are commonly deployed in industrial automation environments. No public exploit code has been identified and the device has not appeared in the CISA KEV catalog.
Arbitrary code execution is possible on Contec CAN 2.0B series communication converter units (CAN-2-WF wireless LAN and CAN-2-USB USB variants) via unrestricted file upload. A remote attacker holding high-privilege credentials can upload a specially crafted file to the device's web interface, resulting in code execution directly on the embedded unit. Reported by JPCERT/CC with a vendor advisory; no public exploit or CISA KEV listing identified at time of analysis.
OS command injection in Contec's CAN-2-WF (Wireless LAN) and CAN-2-USB (USB) industrial communication converter units allows any authenticated user to execute arbitrary operating system commands on the device. The vulnerability, CWE-78, is reachable over the network with low privilege and no user interaction required, yielding full confidentiality, integrity, and availability impact on the affected unit. Reported by JPCERT/CC with a vendor advisory published; no public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis.
Reflected or stored cross-site scripting in the web management interface of Contec's CAN-2-WF (Wireless LAN) and CAN-2-USB (USB Converter) industrial serial communication units allows an adjacent-network attacker to inject and execute arbitrary JavaScript in the browser of an authenticated user who interacts with the crafted content. The vulnerability affects the embedded web UI exposed by these serial-to-network converter devices, which are commonly deployed in industrial automation environments. No public exploit code has been identified and the device has not appeared in the CISA KEV catalog.