JVNDB-2026-033235
Vulnerability from jvndb - Published: 2026-09-14 07:32 - Updated:2026-09-14 07:32
Severity
Summary
Multiple vulnerabilities in Contec CONPROSYS series
Details
CONPROSYS series provided by Contec Co., Ltd. contains multiple vulnerabilities listed below.
- Cross-site scripting (CWE-79) - CVE-2026-82773, CVE-2026-82776, CVE-2026-82788
- OS command injection (CWE-78) - CVE-2026-82774, CVE-2026-82777, CVE-2026-82779
- Exposure of information through directory listing (CWE-548) - CVE-2026-82775, CVE-2026-82778
- Dependency on vulnerable third-party component (CWE-1395)
- This issue is caused by a vulnerability in chart.js (CVE-2020-7746).
- Unrestricted upload of file with dangerous type (CWE-434) - CVE-2026-82780
- Cross-site scripting (CWE-79) - CVE-2026-82781
- Out-of-bounds write (CWE-787) - CVE-2026-82782
- Cross-site request forgery (CWE-352) - CVE-2026-82764
- Plaintext storage of a password (CWE-256) - CVE-2026-82783
- Missing authentication for critical function (CWE-306) - CVE-2026-82784
- Stack-based buffer overflow (CWE-121) - CVE-2026-82785
- Insufficiently protected credentials (CWE-522) - CVE-2026-82786
- Missing authentication for critical function (CWE-306) - CVE-2026-82787
- Eval injection (CWE-95) - CVE-2026-82789
References
Impacted products
| Vendor | Product | |||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-033235.html",
"dc:date": "2026-09-14T16:32+09:00",
"dcterms:issued": "2026-09-14T16:32+09:00",
"dcterms:modified": "2026-09-14T16:32+09:00",
"description": "CONPROSYS series provided by Contec Co., Ltd. contains multiple vulnerabilities listed below.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/79.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/78.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/548.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/1395.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://www.cve.org/CVERecord?id=CVE-2020-7746\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/434.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/79.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/787.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/352.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/256.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/306.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/121.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/522.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/306.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/95.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eCross-site scripting (CWE-79) - CVE-2026-82773, CVE-2026-82776, CVE-2026-82788\u003c/li\u003e\u003cli\u003eOS command injection (CWE-78) - CVE-2026-82774, CVE-2026-82777, CVE-2026-82779\u003c/li\u003e\u003cli\u003eExposure of information through directory listing (CWE-548) - CVE-2026-82775, CVE-2026-82778\u003c/li\u003e\u003cli\u003eDependency on vulnerable third-party component (CWE-1395)\u003c/li\u003e\u003cul\u003e\u003cli\u003eThis issue is caused by a vulnerability in chart.js (CVE-2020-7746).\u003c/li\u003e\u003c/ul\u003e\u003cli\u003eUnrestricted upload of file with dangerous type (CWE-434) - CVE-2026-82780\u003c/li\u003e\u003cli\u003eCross-site scripting (CWE-79) - CVE-2026-82781\u003c/li\u003e\u003cli\u003eOut-of-bounds write (CWE-787) - CVE-2026-82782\u003c/li\u003e\u003cli\u003eCross-site request forgery (CWE-352) - CVE-2026-82764\u003c/li\u003e\u003cli\u003ePlaintext storage of a password (CWE-256) - CVE-2026-82783\u003c/li\u003e\u003cli\u003eMissing authentication for critical function (CWE-306) - CVE-2026-82784\u003c/li\u003e\u003cli\u003eStack-based buffer overflow (CWE-121) - CVE-2026-82785\u003c/li\u003e\u003cli\u003eInsufficiently protected credentials (CWE-522) - CVE-2026-82786\u003c/li\u003e\u003cli\u003eMissing authentication for critical function (CWE-306) - CVE-2026-82787\u003c/li\u003e\u003cli\u003eEval injection (CWE-95) - CVE-2026-82789\u003c/li\u003e\u003c/ul\u003eContec Co., Ltd. reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.",
"link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-033235.html",
"sec:cpe": [
{
"#text": "cpe:/a:contec:conprosys_hmi_system",
"@product": "CONPROSYS HMI System (CHS)",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:configurable_type_cps-pcs341_-ds1-120",
"@product": "Configurable type CPS-PCS341[][]-DS1-1201",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:cps-tm341g5mb-adsc1-931",
"@product": "CPS-TM341G5MB-ADSC1-931",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:cps-tm341gmb-adsc1-931",
"@product": "CPS-TM341GMB-ADSC1-931",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:cps-tm341mb-adsc1-931",
"@product": "CPS-TM341MB-ADSC1-931",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:cpsl-08p1en",
"@product": "CPSL-08P1EN",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:cpsn-eob471ei-",
"@product": "Remote I/O Coupler Unit (EtherNet/IP Adapter) CPSN-EOB471EI-[]1",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:cpsn-mcb271-",
"@product": "Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:cpsn-pcb271-s1-041",
"@product": "Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:integrated_type_cps-pc341_-9201",
"@product": "Integrated Type CPS-PC341[][]-*-9201",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:m2m_controller_configurable_type_cps-mcs341",
"@product": "M2M Controller Configurable type CPS-MCS341*",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:m2m_controller_integrated_type_cps-mc341",
"@product": "M2M Controller Integrated Type CPS-MC341",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:m2m_gateway_configurable_type_cps-mgs341",
"@product": "M2M Gateway Configurable type CPS-MGS341*",
"@vendor": "Contec",
"@version": "2.2"
},
{
"#text": "cpe:/h:contec:m2m_gateway_integrated_type_cps-mg341",
"@product": "M2M Gateway Integrated Type CPS-MG341*",
"@vendor": "Contec",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "6.1",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2026-033235",
"sec:references": [
{
"#text": "https://jvn.jp/en/vu/JVNVU96551518/index.html",
"@id": "JVNVU#96551518",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2020-7746",
"@id": "CVE-2020-7746",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82764",
"@id": "CVE-2026-82764",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82773",
"@id": "CVE-2026-82773",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82774",
"@id": "CVE-2026-82774",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82775",
"@id": "CVE-2026-82775",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82776",
"@id": "CVE-2026-82776",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82777",
"@id": "CVE-2026-82777",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82778",
"@id": "CVE-2026-82778",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82779",
"@id": "CVE-2026-82779",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82780",
"@id": "CVE-2026-82780",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82781",
"@id": "CVE-2026-82781",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82782",
"@id": "CVE-2026-82782",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82783",
"@id": "CVE-2026-82783",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82784",
"@id": "CVE-2026-82784",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82785",
"@id": "CVE-2026-82785",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82786",
"@id": "CVE-2026-82786",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82787",
"@id": "CVE-2026-82787",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82788",
"@id": "CVE-2026-82788",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-82789",
"@id": "CVE-2026-82789",
"@source": "CVE"
},
{
"#text": "https://cwe.mitre.org/data/definitions/121.html",
"@id": "CWE-121",
"@title": "Stack-based Buffer Overflow(CWE-121)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/1395.html",
"@id": "CWE-1395",
"@title": "Dependency on Vulnerable Third-Party Component(CWE-1395)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/256.html",
"@id": "CWE-256",
"@title": "Unprotected Storage of Credentials(CWE-256)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/306.html",
"@id": "CWE-306",
"@title": "Missing Authentication for Critical Function(CWE-306)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-352",
"@title": "Cross-Site Request Forgery(CWE-352)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/434.html",
"@id": "CWE-434",
"@title": "Unrestricted Upload of File with Dangerous Type(CWE-434)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/522.html",
"@id": "CWE-522",
"@title": "Insufficiently Protected Credentials(CWE-522)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/548.html",
"@id": "CWE-548",
"@title": "Exposure of Information Through Directory Listing(CWE-548)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-78",
"@title": "OS Command Injection(CWE-78)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/787.html",
"@id": "CWE-787",
"@title": "Out-of-bounds Write(CWE-787)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-79",
"@title": "Cross-site Scripting(CWE-79)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/95.html",
"@id": "CWE-95",
"@title": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)(CWE-95)"
}
],
"title": "Multiple vulnerabilities in Contec CONPROSYS series"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…