CVE-2026-82779

An OS command injection flaw (CWE-78) exists in Contec's CONPROSYS TM Series of industrial edge computers/M2M-IoT controllers: the product fails to neutralize special elements before incorporating input into an OS command. An attacker who can log in to the device — any authenticated account, including a low-privileged one — can inject arbitrary shell commands that execute on the controller, effectively giving full control of the unit (high impact to confidentiality, integrity, and availability; CVSS v4.0 8.7). The flaw affects CONPROSYS TM Series deployments, which are typically used for industrial monitoring, control, and remote data collection in factories and infrastructure. Because exploitation requires valid credentials plus network access to the device's interface, internet-exposed consoles and shared or weak device accounts are the principal risk. There is no known in-the-wild exploitation, no public proof of concept, and the CVE is not on the CISA KEV catalog.

What to do: Apply the fixed firmware/software Contec issued for the CONPROSYS TM Series (check the Contec/JPCERT advisory for the exact fixed versions), noting that exploitation needs only a low-privileged login. Until patched, remove device management/web interfaces from the internet, restrict access to trusted VPN or admin subnets, and audit and rotate all device account credentials. Review device logs for unexpected command execution, processes, or configuration changes and escalate anomalies to your SOC.