Pc Helper Wireless I O Dio 0404Ry Lwf
Monthly
Cross-site scripting in the embedded web management interfaces of Contec Co., Ltd. PC-HELPER Wireless I/O DIO-0404RY-LWF and DIO-0404RY-LWF-US industrial modules allows a low-privilege authenticated attacker to inject malicious script that executes in the browser session of another logged-in user. The CVSS 4.0 score of 4.8 (Medium) reflects mandatory prior authentication (PR:L) and required active victim interaction (UI:A), with impact confined to the subsequent browser context rather than the device itself. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site request forgery affects a broad range of Contec industrial data loggers, flow computers, and remote I/O coupler units, allowing network-reachable unauthenticated attackers to trigger unintended device operations against authenticated operator sessions. Per the CVSS 4.0 vector (AV:N/AC:L/UI:A), no attacker privileges are required - only a logged-in user who visits an attacker-controlled web page during an active management session. JPCERT/CC coordinated three separate JVN advisories (JVNVU99009004, JVNVU96551518, JVNVU90314828) covering distinct Contec product families, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in the embedded web management interfaces of Contec Co., Ltd. PC-HELPER Wireless I/O DIO-0404RY-LWF and DIO-0404RY-LWF-US industrial modules allows a low-privilege authenticated attacker to inject malicious script that executes in the browser session of another logged-in user. The CVSS 4.0 score of 4.8 (Medium) reflects mandatory prior authentication (PR:L) and required active victim interaction (UI:A), with impact confined to the subsequent browser context rather than the device itself. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site request forgery affects a broad range of Contec industrial data loggers, flow computers, and remote I/O coupler units, allowing network-reachable unauthenticated attackers to trigger unintended device operations against authenticated operator sessions. Per the CVSS 4.0 vector (AV:N/AC:L/UI:A), no attacker privileges are required - only a logged-in user who visits an attacker-controlled web page during an active management session. JPCERT/CC coordinated three separate JVN advisories (JVNVU99009004, JVNVU96551518, JVNVU90314828) covering distinct Contec product families, and no public exploit code or CISA KEV listing has been identified at time of analysis.