CVE-2026-82774

CVE-2026-82774 is an OS command injection flaw (CWE-78) caused by improper neutralization of special elements in CONTEC's CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series, industrial IoT edge devices. A remote attacker with valid login credentials can submit crafted input containing special characters to a command parameter, causing the device to execute an arbitrary operating-system command. Successful exploitation gives the attacker full control of the appliance with high impact on its confidentiality, integrity, and availability (CVSS v4.0: 8.7), which typically means compromise of the industrial data collection, monitoring, and remote-management functions the gateway/controller performs. Only authenticated users can trigger the bug, so the practical risk combines with weak, default, or stolen credentials on internet-reachable management interfaces. There is no known public proof of concept, the flaw is not in the CISA KEV catalog, and no exploitation has been reported to date.

What to do: Apply CONTEC's patched firmware per the JPCERT/CONTEC advisory, since the advisory does not list fixed version numbers — check the vendor page for your specific model. Restrict management/web interfaces to trusted internal networks or VPNs rather than exposing them to the internet, and replace any default or shared credentials with strong unique ones since exploitation requires login. Review device logs for unexpected logins or command execution from unfamiliar sources or times.