CVE-2026-82762

An OS command injection vulnerability (CWE-78) exists in Contec's FX5000, FX4000, and FX3000 series devices, caused by improper neutralization of special elements in input that is passed to operating-system commands. The flaw is exploitable over the network by an attacker who can log in to the product with valid, low-privilege credentials, giving it a CVSS 4.0 score of 8.7 (high). Successful exploitation allows arbitrary OS command execution on the affected device, compromising its confidentiality, integrity, and availability. Organizations running these Contec FX-series units — typically industrial/factory-automation or control environments — are affected, with the strongest risk on devices whose login interfaces are reachable by untrusted users or networks. No public proof-of-concept is known, the CVE is not in CISA's KEV catalog, and there is no evidence of exploitation in the wild.

What to do: Update affected FX3000, FX4000, and FX5000 devices to the fixed firmware versions listed in Contec's official advisory (issued via JPCERT/Contec support) as soon as they are available. Until patched, restrict login and management access to trusted administrative networks and users only, enforce strong unique credentials, and disable or prune unused accounts since the flaw requires valid login. Monitor device logs and network traffic for unexpected commands or configuration changes originating from device user sessions.