Integrated Type Cps Pc341 9201
Monthly
OS command injection in Contec's CONPROSYS PAC Series industrial automation controllers allows any authenticated user to execute arbitrary OS-level commands on the device. Affected hardware includes the Integrated Type CPS-PC341 and Configurable Type CPS-PCS341 series programmable automation controllers, reported by JPCERT/CC. No public exploit code has been identified at time of analysis, but successful exploitation grants full control over the controller's underlying operating system.
Directory listing exposure in CONTEC CONPROSYS PAC Series enables unauthenticated network attackers to enumerate internal directory structures by requesting a specific URL on the device's embedded web server. Affected models include the Integrated Type CPS-PC341 and Configurable Type CPS-PCS341, both deployed in industrial automation environments. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; impact is limited to information disclosure that could assist subsequent reconnaissance against the device.
Cross-site scripting in Contec's CONPROSYS PAC Series industrial programmable automation controllers allows a remote unauthenticated attacker to inject arbitrary JavaScript that executes in the web browser of a logged-in management interface user. The flaw affects the Integrated Type CPS-PC341 and Configurable Type CPS-PCS341 product lines, with the attacker relying on social engineering to cause an authenticated operator to trigger the payload. No public exploit code or active exploitation has been identified at the time of analysis.
OS command injection in Contec's CONPROSYS PAC Series industrial automation controllers allows any authenticated user to execute arbitrary OS-level commands on the device. Affected hardware includes the Integrated Type CPS-PC341 and Configurable Type CPS-PCS341 series programmable automation controllers, reported by JPCERT/CC. No public exploit code has been identified at time of analysis, but successful exploitation grants full control over the controller's underlying operating system.
Directory listing exposure in CONTEC CONPROSYS PAC Series enables unauthenticated network attackers to enumerate internal directory structures by requesting a specific URL on the device's embedded web server. Affected models include the Integrated Type CPS-PC341 and Configurable Type CPS-PCS341, both deployed in industrial automation environments. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; impact is limited to information disclosure that could assist subsequent reconnaissance against the device.
Cross-site scripting in Contec's CONPROSYS PAC Series industrial programmable automation controllers allows a remote unauthenticated attacker to inject arbitrary JavaScript that executes in the web browser of a logged-in management interface user. The flaw affects the Integrated Type CPS-PC341 and Configurable Type CPS-PCS341 product lines, with the attacker relying on social engineering to cause an authenticated operator to trigger the payload. No public exploit code or active exploitation has been identified at the time of analysis.