CVE-2026-82793

CVE-2026-82793 is an unrestricted file upload vulnerability (CWE-434) in Contec's CAN 2.0B Communication Wireless LAN / USB Converter Unit, a device that bridges CAN bus traffic onto wireless or USB-connected networks. A remote attacker who already holds valid (high-privilege) authentication credentials can upload a specially crafted file of a dangerous type, and the product will accept and process it, resulting in execution of arbitrary code on the converter itself. Successful exploitation gives the attacker full control of the device (high impact to confidentiality, integrity, and availability), which could allow manipulation of CAN bus traffic passing through the converter or use of the device as a foothold in an industrial or automotive network. The CVSS 4.0 score is 8.6 (high), but exploitation requires existing credentials, so exposed devices with weak or default accounts on reachable management interfaces are the primary risk. There is no known public proof of concept, the flaw is not on the CISA KEV catalog, and no exploitation in the wild has been reported as of this analysis.

What to do: Check the Contec and JPCERT advisories for this CVE and apply any firmware update as soon as one is available. In the meantime, remove the converter's management/upload interface from internet exposure, restrict it to an isolated industrial network segment, and enforce strong unique credentials since the flaw requires authentication. Audit device accounts for default or shared credentials and monitor device logs for unexpected file uploads or configuration changes.