Sga1000
Monthly
Path traversal in Contec SGA1000 allows a network attacker with FTP credentials to read and overwrite arbitrary files on the device filesystem. Reported by JPCERT and documented in JVN advisory JVNVU99009004, the flaw affects all known SGA1000 versions and exposes sensitive server-side files - including configuration, credentials, and system data - to unauthorized disclosure and modification via crafted FTP path arguments. No public exploit code or confirmed active exploitation has been identified at time of analysis.
OS command injection in Contec's SGA1000 device allows an authenticated network attacker to execute arbitrary commands on the underlying operating system. The flaw (CWE-78) arises from insufficient sanitization of user-supplied input before it is passed to system shell calls, affecting all known versions per the wildcard CPE specifier. Reported via JPCERT/CC and confirmed by the vendor's own security advisory; no public exploit code has been identified at time of analysis.
Cross-site scripting (XSS) in the Contec SGA1000 web management interface allows an adjacent-network attacker to inject and execute arbitrary JavaScript in the browser of an authenticated user who interacts with malicious content. The vulnerability is classified CWE-79 (Improper Neutralization of Input During Web Page Generation) and was disclosed via JPCERT/CC alongside a vendor security advisory from Contec. No public exploit code has been identified at time of analysis, and EPSS data was not provided in source intelligence.
Cross-site request forgery affects a broad range of Contec industrial data loggers, flow computers, and remote I/O coupler units, allowing network-reachable unauthenticated attackers to trigger unintended device operations against authenticated operator sessions. Per the CVSS 4.0 vector (AV:N/AC:L/UI:A), no attacker privileges are required - only a logged-in user who visits an attacker-controlled web page during an active management session. JPCERT/CC coordinated three separate JVN advisories (JVNVU99009004, JVNVU96551518, JVNVU90314828) covering distinct Contec product families, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Contec SGA1000 allows a network attacker with FTP credentials to read and overwrite arbitrary files on the device filesystem. Reported by JPCERT and documented in JVN advisory JVNVU99009004, the flaw affects all known SGA1000 versions and exposes sensitive server-side files - including configuration, credentials, and system data - to unauthorized disclosure and modification via crafted FTP path arguments. No public exploit code or confirmed active exploitation has been identified at time of analysis.
OS command injection in Contec's SGA1000 device allows an authenticated network attacker to execute arbitrary commands on the underlying operating system. The flaw (CWE-78) arises from insufficient sanitization of user-supplied input before it is passed to system shell calls, affecting all known versions per the wildcard CPE specifier. Reported via JPCERT/CC and confirmed by the vendor's own security advisory; no public exploit code has been identified at time of analysis.
Cross-site scripting (XSS) in the Contec SGA1000 web management interface allows an adjacent-network attacker to inject and execute arbitrary JavaScript in the browser of an authenticated user who interacts with malicious content. The vulnerability is classified CWE-79 (Improper Neutralization of Input During Web Page Generation) and was disclosed via JPCERT/CC alongside a vendor security advisory from Contec. No public exploit code has been identified at time of analysis, and EPSS data was not provided in source intelligence.
Cross-site request forgery affects a broad range of Contec industrial data loggers, flow computers, and remote I/O coupler units, allowing network-reachable unauthenticated attackers to trigger unintended device operations against authenticated operator sessions. Per the CVSS 4.0 vector (AV:N/AC:L/UI:A), no attacker privileges are required - only a logged-in user who visits an attacker-controlled web page during an active management session. JPCERT/CC coordinated three separate JVN advisories (JVNVU99009004, JVNVU96551518, JVNVU90314828) covering distinct Contec product families, and no public exploit code or CISA KEV listing has been identified at time of analysis.