Cpsl 08P1En
Monthly
Missing authentication on a critical function in the Contec CPSL-08P1EN allows a network-reachable attacker to operate the device without supplying credentials. The flaw (CWE-306) means a protected management or control function is reachable directly over the network with no authentication gate, giving an adversary the same effective access as a legitimate administrator. No public exploit or CISA KEV listing exists at time of analysis, but the straightforward exploitation path (no complexity, no user interaction) lowers the bar for opportunistic targeting of Internet-exposed or weakly-segmented devices.
Cross-site scripting in the embedded web management interface of Contec's CPSL-08P1EN industrial network device allows a remote unauthenticated attacker to inject malicious script that executes within an authenticated operator's browser session. The CVSS 4.0 score of 5.1 (AV:N/PR:N/UI:A) reflects that while no attacker credentials are required, active interaction from a logged-in user is necessary to trigger the payload. No public exploit code or confirmed active exploitation is identified at time of analysis.
Missing authentication on a critical function in the Contec CPSL-08P1EN allows a network-reachable attacker to operate the device without supplying credentials. The flaw (CWE-306) means a protected management or control function is reachable directly over the network with no authentication gate, giving an adversary the same effective access as a legitimate administrator. No public exploit or CISA KEV listing exists at time of analysis, but the straightforward exploitation path (no complexity, no user interaction) lowers the bar for opportunistic targeting of Internet-exposed or weakly-segmented devices.
Cross-site scripting in the embedded web management interface of Contec's CPSL-08P1EN industrial network device allows a remote unauthenticated attacker to inject malicious script that executes within an authenticated operator's browser session. The CVSS 4.0 score of 5.1 (AV:N/PR:N/UI:A) reflects that while no attacker credentials are required, active interaction from a logged-in user is necessary to trigger the payload. No public exploit code or confirmed active exploitation is identified at time of analysis.