Rp Wah Sr2
Monthly
Remote code execution is possible in Contec RP-WAH-SR Series wireless access point devices via a classic buffer overflow in the product's web service. A low-privileged remote attacker can send a specially crafted HTTP request to trigger the overflow and execute arbitrary code on the device. All four model variants (SR1, SR2, SR12, SR22) are confirmed affected per CPE data; the vulnerability was disclosed via JPCERT and a Contec security advisory with no KEV listing or public POC at time of analysis.
Cross-site scripting in the Contec RP-WAH-SR Series web management interface allows an authenticated low-privilege attacker to inject and execute arbitrary JavaScript in the browser of another logged-in user. The CVSS 4.0 vector (PR:L/UI:A) confirms exploitation requires both an authenticated session to plant the payload and a separate victim user who must actively interact with the affected page. Reported by JPCERT with no public exploit or KEV listing at time of analysis.
Cross-site request forgery affects a broad range of Contec industrial data loggers, flow computers, and remote I/O coupler units, allowing network-reachable unauthenticated attackers to trigger unintended device operations against authenticated operator sessions. Per the CVSS 4.0 vector (AV:N/AC:L/UI:A), no attacker privileges are required - only a logged-in user who visits an attacker-controlled web page during an active management session. JPCERT/CC coordinated three separate JVN advisories (JVNVU99009004, JVNVU96551518, JVNVU90314828) covering distinct Contec product families, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Contec RP-WAH-SR Series wireless access point devices via a classic buffer overflow in the product's web service. A low-privileged remote attacker can send a specially crafted HTTP request to trigger the overflow and execute arbitrary code on the device. All four model variants (SR1, SR2, SR12, SR22) are confirmed affected per CPE data; the vulnerability was disclosed via JPCERT and a Contec security advisory with no KEV listing or public POC at time of analysis.
Cross-site scripting in the Contec RP-WAH-SR Series web management interface allows an authenticated low-privilege attacker to inject and execute arbitrary JavaScript in the browser of another logged-in user. The CVSS 4.0 vector (PR:L/UI:A) confirms exploitation requires both an authenticated session to plant the payload and a separate victim user who must actively interact with the affected page. Reported by JPCERT with no public exploit or KEV listing at time of analysis.
Cross-site request forgery affects a broad range of Contec industrial data loggers, flow computers, and remote I/O coupler units, allowing network-reachable unauthenticated attackers to trigger unintended device operations against authenticated operator sessions. Per the CVSS 4.0 vector (AV:N/AC:L/UI:A), no attacker privileges are required - only a logged-in user who visits an attacker-controlled web page during an active management session. JPCERT/CC coordinated three separate JVN advisories (JVNVU99009004, JVNVU96551518, JVNVU90314828) covering distinct Contec product families, and no public exploit code or CISA KEV listing has been identified at time of analysis.