M2M Gateway Configurable Type Cps Mgs341
Monthly
OS command injection in CONPROSYS M2M Gateway and M2M Controller Series (CONTEC Co., Ltd.) allows an authenticated attacker to execute arbitrary operating system commands on affected industrial gateway devices. The vulnerability affects both the integrated and configurable variants of the CPS-MG341, CPS-MGS341, CPS-MC341, and CPS-MCS341 product lines, which are OT/IoT bridging devices commonly deployed in industrial automation environments. Exploitation requires only valid login credentials, and the CVSS 4.0 base score of 8.7 reflects high impact across confidentiality, integrity, and availability with no special attack conditions beyond authentication.
Directory listing exposure in Contec's CONPROSYS M2M Gateway and M2M Controller Series allows a remote attacker to enumerate server-side directory structures by accessing a specific URL on the device's web interface. The affected hardware includes both integrated and configurable variants of the CPS-MG341, CPS-MGS341, CPS-MC341, and CPS-MCS341 product lines. Exposed directory listings reveal file and path structures that can facilitate reconnaissance for follow-on attacks against these industrial gateway devices. No public exploit or active exploitation has been identified at time of analysis.
Cross-site scripting in the embedded web management interface of Contec CONPROSYS M2M Gateway and Controller Series devices (CPS-MG341, CPS-MGS341, CPS-MC341, CPS-MCS341) enables unauthenticated network attackers to inject arbitrary JavaScript that executes in the browser of a logged-in operator or administrator. The CVSS 4.0 vector scores 5.1 and confirms impact is entirely browser-side (SC:L/SI:L; VC:N/VI:N/VA:N), meaning the device itself is not directly compromised. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in CONPROSYS M2M Gateway and M2M Controller Series (CONTEC Co., Ltd.) allows an authenticated attacker to execute arbitrary operating system commands on affected industrial gateway devices. The vulnerability affects both the integrated and configurable variants of the CPS-MG341, CPS-MGS341, CPS-MC341, and CPS-MCS341 product lines, which are OT/IoT bridging devices commonly deployed in industrial automation environments. Exploitation requires only valid login credentials, and the CVSS 4.0 base score of 8.7 reflects high impact across confidentiality, integrity, and availability with no special attack conditions beyond authentication.
Directory listing exposure in Contec's CONPROSYS M2M Gateway and M2M Controller Series allows a remote attacker to enumerate server-side directory structures by accessing a specific URL on the device's web interface. The affected hardware includes both integrated and configurable variants of the CPS-MG341, CPS-MGS341, CPS-MC341, and CPS-MCS341 product lines. Exposed directory listings reveal file and path structures that can facilitate reconnaissance for follow-on attacks against these industrial gateway devices. No public exploit or active exploitation has been identified at time of analysis.
Cross-site scripting in the embedded web management interface of Contec CONPROSYS M2M Gateway and Controller Series devices (CPS-MG341, CPS-MGS341, CPS-MC341, CPS-MCS341) enables unauthenticated network attackers to inject arbitrary JavaScript that executes in the browser of a logged-in operator or administrator. The CVSS 4.0 vector scores 5.1 and confirms impact is entirely browser-side (SC:L/SI:L; VC:N/VI:N/VA:N), meaning the device itself is not directly compromised. No public exploit code or CISA KEV listing has been identified at time of analysis.