CVE-2026-82780

Contec's CONPROSYS TM Series industrial IoT gateways contain an unrestricted file upload vulnerability (CWE-434) that allows a remote authenticated attacker to upload a specially crafted file and execute arbitrary commands on the device. Exploitation requires valid login credentials for the product's interface, but once inside, the attacker gains full control of the gateway with high impact on its confidentiality, integrity, and availability. The flaw carries a CVSS 4.0 score of 8.7 (high) and was reported through Japanese CERT (JPCERT), consistent with Contec's footprint in Japanese industrial and building-monitoring deployments. Organizations running CONPROSYS TM Series devices for remote monitoring or control are affected. There is no known public proof of concept and no confirmed in-the-wild exploitation at this time.

What to do: Apply the firmware update specified in Contec's advisory for the affected CONPROSYS TM Series models as soon as it is available. In the interim, restrict management/upload access to trusted networks via VPN or firewall rules, review device logs for unexpected file uploads or unfamiliar account activity, and rotate credentials since exploitation requires valid authentication. Monitor the JPCERT/Contec advisories for the exact affected version list and update guidance.