CVE-2026-82770

CVE-2026-82770 is a classic buffer overflow (CWE-120) in the web service of Contec's RP-WAH-SR Series devices. A remote attacker who can reach the device's web interface and holds low-level privileges (the CVSS v4.0 vector specifies PR:L, implying some authentication/basic access is required) can send a specially crafted request that overflows a buffer and executes an arbitrary program on the device. Successful exploitation fully compromises the unit, with high impact to confidentiality, integrity, and availability (CVSS v4.0: 8.7, network vector, low attack complexity). Any organization running RP-WAH-SR Series units with the web service enabled — especially devices reachable from untrusted networks or the internet — is affected. There is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no exploitation has been observed to date.

What to do: Check the Contec/JPCERT advisory for a fixed firmware release and upgrade affected RP-WAH-SR units as soon as a patched version is confirmed. In the meantime, keep the web service off the internet by restricting access to trusted internal networks or a VPN, enforce strong non-default credentials on the web interface (the flaw requires low privileges), and monitor the device's logs for oversized or anomalous HTTP requests.