CVE-2026-82777

Contec's CONPROSYS PAC Series programmable automation controllers contain an OS command injection flaw (CWE-78) caused by improper neutralization of special elements in input passed to operating-system commands. An attacker with valid login credentials to the device can submit crafted input, causing arbitrary OS commands to execute on the controller. Successful exploitation gives full control of the affected unit with high impact on confidentiality, integrity, and availability — significant in industrial control settings where these controllers monitor and operate physical processes. The flaw requires authentication (CVSS 4.0: 8.7, PR:L), so it is not exploitable by anonymous remote attackers, but compromised or default credentials would lower that barrier. No public proof-of-concept is known and the CVE is not in CISA's KEV catalog, with no evidence of in-the-wild exploitation to date.

What to do: Check the Contec/JPCERT/CC advisory for fixed firmware and upgrade affected CONPROSYS PAC units as patched versions become available. Until then, restrict management/login access to trusted networks via firewall rules or VPN, eliminate default and shared credentials, and grant device logins only to necessary accounts since exploitation requires authentication. Monitor device logs for unexpected command execution or configuration changes by low-privilege users.