Fxa5020
Monthly
Path traversal via FTP in Contec FX5000, FX4000, and FX3000 series industrial programmable controllers allows an authenticated FTP user to read or modify arbitrary files on the device filesystem. The affected products span a broad range of industrial OT endpoints including Ethernet, serial, and wireless variants. With no public exploit identified and a CVSS 4.0 score of 8.6, the primary risk is to environments where FTP access is exposed to untrusted users or network segments without adequate segmentation.
OS command injection in Contec FX5000, FX4000, and FX3000 series industrial data loggers and remote I/O units allows authenticated network attackers to execute arbitrary operating system commands on affected devices. Exploitation requires valid credentials to the device management interface but no additional configuration or user interaction, giving a successful attacker full command execution capability at OS level. Reported by JPCERT and coordinated via JVN; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Cross-site scripting in Contec FX5000, FX4000, and FX3000 series industrial data loggers allows a low-privileged authenticated attacker to inject arbitrary scripts that execute in a victim's web browser when viewing attacker-controlled content via the device web interface. The vulnerability was reported by JPCERT/CC and affects a broad range of OT/ICS field devices used in industrial monitoring and automation. No public exploit code or CISA KEV listing is present, and the CVSS 4.0 score of 4.8 reflects the constrained real-world impact.
Cross-site request forgery affects a broad range of Contec industrial data loggers, flow computers, and remote I/O coupler units, allowing network-reachable unauthenticated attackers to trigger unintended device operations against authenticated operator sessions. Per the CVSS 4.0 vector (AV:N/AC:L/UI:A), no attacker privileges are required - only a logged-in user who visits an attacker-controlled web page during an active management session. JPCERT/CC coordinated three separate JVN advisories (JVNVU99009004, JVNVU96551518, JVNVU90314828) covering distinct Contec product families, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal via FTP in Contec FX5000, FX4000, and FX3000 series industrial programmable controllers allows an authenticated FTP user to read or modify arbitrary files on the device filesystem. The affected products span a broad range of industrial OT endpoints including Ethernet, serial, and wireless variants. With no public exploit identified and a CVSS 4.0 score of 8.6, the primary risk is to environments where FTP access is exposed to untrusted users or network segments without adequate segmentation.
OS command injection in Contec FX5000, FX4000, and FX3000 series industrial data loggers and remote I/O units allows authenticated network attackers to execute arbitrary operating system commands on affected devices. Exploitation requires valid credentials to the device management interface but no additional configuration or user interaction, giving a successful attacker full command execution capability at OS level. Reported by JPCERT and coordinated via JVN; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Cross-site scripting in Contec FX5000, FX4000, and FX3000 series industrial data loggers allows a low-privileged authenticated attacker to inject arbitrary scripts that execute in a victim's web browser when viewing attacker-controlled content via the device web interface. The vulnerability was reported by JPCERT/CC and affects a broad range of OT/ICS field devices used in industrial monitoring and automation. No public exploit code or CISA KEV listing is present, and the CVSS 4.0 score of 4.8 reflects the constrained real-world impact.
Cross-site request forgery affects a broad range of Contec industrial data loggers, flow computers, and remote I/O coupler units, allowing network-reachable unauthenticated attackers to trigger unintended device operations against authenticated operator sessions. Per the CVSS 4.0 vector (AV:N/AC:L/UI:A), no attacker privileges are required - only a logged-in user who visits an attacker-controlled web page during an active management session. JPCERT/CC coordinated three separate JVN advisories (JVNVU99009004, JVNVU96551518, JVNVU90314828) covering distinct Contec product families, and no public exploit code or CISA KEV listing has been identified at time of analysis.