CVE-2026-82789

CONTEC's CONPROSYS HMI System (CHS), a web-based HMI used for industrial monitoring and control, contains an eval injection flaw (CWE-95) in which directives passed into dynamically evaluated code are not properly neutralized. An attacker who can log in to the product with valid (even low-privileged) credentials can submit crafted input that gets evaluated, resulting in arbitrary code execution on the HMI server. Successful exploitation could allow tampering with monitoring displays, manipulating collected process data, or pivoting deeper into the OT network, and carries a high CVSS v4.0 score of 8.7. Organizations running CHS in factory or building-automation environments are affected, though the advisory does not specify particular version ranges. No public proof-of-concept exists and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not currently known to be occurring.

What to do: Apply the vendor's fixed version as identified in the CONTEC/JPCERT (JVN) advisory; until then, strictly limit who can log in to CHS with strong, unique credentials and role-based access, and keep the HMI interface off the internet inside a segmented OT network. Also review authentication and application logs for unexpected logins or unusual script/evaluation activity by legitimate accounts, since exploitation requires valid credentials.