CVE-2026-82791

An OS command injection flaw (CWE-78) exists in Contec's CAN 2.0B Communication Wireless LAN / USB Converter Unit, caused by improper neutralization of special elements used in an OS command. An attacker who can log in to the device — for example using default or low-privilege credentials — can inject and execute arbitrary operating system commands on the unit. Successful exploitation gives full control over the converter's underlying system with high impact to confidentiality, integrity, and availability (CVSS v4.0: 8.7), and could allow tampering with the CAN bus traffic the device bridges. Affected deployments are typically industrial, manufacturing, and automotive engineering environments that use these converters to relay CAN 2.0B traffic over wireless LAN or USB. No public proof-of-concept exists and the issue is not listed in CISA's KEV catalog, so exploitation is not known to be in the wild, though internet-exposed units with default credentials remain at meaningful risk.

What to do: Restrict the converter's login/management interface to trusted internal networks or VPN access and never expose it directly to the internet; replace any default or shared credentials with strong unique ones, since exploitation requires the attacker to log in. Check the Contec vendor advisory (via JPCERT, the assigning CNA) for a fixed firmware version and upgrade affected units when a patch is released. Monitor device behavior and logs for unexpected command execution or configuration changes indicative of compromise.