Remote I O Coupler Unit Server Type Cpsn Mcb271
Monthly
Credential disclosure in Contec's Remote I/O Coupler Unit (Server Type) CPSN-MCB271 enables an attacker who obtains a device backup file to recover sensitive credentials stored within it in an insufficiently protected form. The root cause (CWE-522) means credentials are not rendered unrecoverable within backup archives, so any party who accesses a backup file can extract usable authentication material. Reported by JPCERT/CC with a CVSS 4.0 score of 8.2, no public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Stack-based buffer overflow in Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* allows an authenticated remote attacker to trigger a denial-of-service condition by sending a specially crafted network request. The overflow (CWE-121) corrupts stack memory, crashing the device firmware without evidence of code execution capability. No public exploit or KEV listing exists; JPCERT/CC published the advisory coordinated with Contec.
Unauthenticated REST API access on Contec's CPSN-MCB271 series Remote I/O Coupler Unit (Server Type) allows any network-reachable attacker to read industrial I/O sensor values and issue output control commands without credentials. The vulnerability arises from a complete absence of authentication on the device's REST interface, exposing physical process control functions directly over the network. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a straightforward, condition-free exploitation path.
Plaintext credential storage in CONTEC's CONPROSYS nano Series industrial remote I/O devices exposes passwords to attackers with physical device access. Affecting multiple coupler unit models (server-type, EtherNet/IP adapter, and software PLC variants), the flaw means credentials are recoverable without decryption from device storage. No public exploit code or active exploitation has been identified; the physical access prerequisite and high attack complexity substantially limit real-world risk.
Out-of-bounds write in CONPROSYS nano Series Remote I/O Coupler Units from Contec Co., Ltd. enables remote attackers with low-privilege network access to crash affected industrial automation devices by sending specially crafted network requests. Affected hardware includes server-type couplers (CPSN-MCB271), EtherNet/IP adapter variants (CPSN-EOB471EI), and software PLC-type units (CPSN-PCB271-S1-041), placing operational technology environments at risk of physical process disruption from device-level DoS. No active exploitation has been confirmed and no public proof-of-concept code is known at time of analysis.
Cross-site scripting in CONTEC's CONPROSYS nano Series industrial remote I/O coupler units allows an unauthenticated attacker to execute arbitrary JavaScript in the web browser of a logged-in operator. The affected products are OT/ICS edge devices (CPSN-MCB271, CPSN-EOB471EI, CPSN-PCB271-S1-041) used in industrial automation environments where their web management interfaces are the attack surface. If exploited, an attacker could steal session credentials, perform unauthorized device configuration changes, or pivot to broader OT network access through the operator's authenticated session. No public exploit code has been identified at time of analysis.
Cross-site request forgery affects a broad range of Contec industrial data loggers, flow computers, and remote I/O coupler units, allowing network-reachable unauthenticated attackers to trigger unintended device operations against authenticated operator sessions. Per the CVSS 4.0 vector (AV:N/AC:L/UI:A), no attacker privileges are required - only a logged-in user who visits an attacker-controlled web page during an active management session. JPCERT/CC coordinated three separate JVN advisories (JVNVU99009004, JVNVU96551518, JVNVU90314828) covering distinct Contec product families, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Credential disclosure in Contec's Remote I/O Coupler Unit (Server Type) CPSN-MCB271 enables an attacker who obtains a device backup file to recover sensitive credentials stored within it in an insufficiently protected form. The root cause (CWE-522) means credentials are not rendered unrecoverable within backup archives, so any party who accesses a backup file can extract usable authentication material. Reported by JPCERT/CC with a CVSS 4.0 score of 8.2, no public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Stack-based buffer overflow in Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* allows an authenticated remote attacker to trigger a denial-of-service condition by sending a specially crafted network request. The overflow (CWE-121) corrupts stack memory, crashing the device firmware without evidence of code execution capability. No public exploit or KEV listing exists; JPCERT/CC published the advisory coordinated with Contec.
Unauthenticated REST API access on Contec's CPSN-MCB271 series Remote I/O Coupler Unit (Server Type) allows any network-reachable attacker to read industrial I/O sensor values and issue output control commands without credentials. The vulnerability arises from a complete absence of authentication on the device's REST interface, exposing physical process control functions directly over the network. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a straightforward, condition-free exploitation path.
Plaintext credential storage in CONTEC's CONPROSYS nano Series industrial remote I/O devices exposes passwords to attackers with physical device access. Affecting multiple coupler unit models (server-type, EtherNet/IP adapter, and software PLC variants), the flaw means credentials are recoverable without decryption from device storage. No public exploit code or active exploitation has been identified; the physical access prerequisite and high attack complexity substantially limit real-world risk.
Out-of-bounds write in CONPROSYS nano Series Remote I/O Coupler Units from Contec Co., Ltd. enables remote attackers with low-privilege network access to crash affected industrial automation devices by sending specially crafted network requests. Affected hardware includes server-type couplers (CPSN-MCB271), EtherNet/IP adapter variants (CPSN-EOB471EI), and software PLC-type units (CPSN-PCB271-S1-041), placing operational technology environments at risk of physical process disruption from device-level DoS. No active exploitation has been confirmed and no public proof-of-concept code is known at time of analysis.
Cross-site scripting in CONTEC's CONPROSYS nano Series industrial remote I/O coupler units allows an unauthenticated attacker to execute arbitrary JavaScript in the web browser of a logged-in operator. The affected products are OT/ICS edge devices (CPSN-MCB271, CPSN-EOB471EI, CPSN-PCB271-S1-041) used in industrial automation environments where their web management interfaces are the attack surface. If exploited, an attacker could steal session credentials, perform unauthorized device configuration changes, or pivot to broader OT network access through the operator's authenticated session. No public exploit code has been identified at time of analysis.
Cross-site request forgery affects a broad range of Contec industrial data loggers, flow computers, and remote I/O coupler units, allowing network-reachable unauthenticated attackers to trigger unintended device operations against authenticated operator sessions. Per the CVSS 4.0 vector (AV:N/AC:L/UI:A), no attacker privileges are required - only a logged-in user who visits an attacker-controlled web page during an active management session. JPCERT/CC coordinated three separate JVN advisories (JVNVU99009004, JVNVU96551518, JVNVU90314828) covering distinct Contec product families, and no public exploit code or CISA KEV listing has been identified at time of analysis.