CVE-2026-82783

Plaintext Password Storage Allows Credential Theft with Physical Access

View on CVE.org
Published Sep 14, 2026 CVSS 4.0 · 4.1 Medium EPSS < 1% KEV · Not listed
Description
Plaintext storage of a password issue exists in CONPROSYS nano Series . If this vulnerability is exploited, an attacker with physical access to the product may obtain credentials.

Analysis

AI-generated

Technical impact

Plaintext passwords are stored in the CONPROSYS nano Series firmware, allowing an attacker who physically reaches the device to read the credentials and compromise access to the remote I/O units. The flaw is a weakness in password storage (CWE-256) that gives direct exposure of secret information.

Affected Systems

All Contec CPSN models are affected, including the Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041, the Remote I/O Coupler Unit (EtherNet/IP Adapter) CPSN-EOB471EI-[]1, and the Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. No specific firmware or hardware revision numbers are provided in the advisory.

Risk and Exploitability

The vulnerability received a CVSS 4.1 rating, indicating moderate impact. The EPSS score is < 1%, showing a very low but non‑zero likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to have physical access, so the likelihood of remote exploitation is low, but the potential for credential compromise remains if the device is not secured against physical tampering.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Retrieve and install the latest firmware or security update from Contec for the affected CPSN devices
  • Restrict physical access to the devices by placing them in lockable enclosures or controlling access with appropriate security policies
  • If, consider disabling nonessential remote access functions or replacing the unit with a version that correctly encrypts stored credentials

Generated by OpenCVE AI on September 15, 2026 at 15:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Contec
Contec programmable Remote I/o Coupler Unit (software Plc Type) Cpsn-pcb271-s1-041
Contec remote I/o Coupler Unit (ethernet/ip Adapter) Cpsn-eob471ei-[]1
Contec remote I/o Coupler Unit (server Type) Cpsn-mcb271-*
Vendors & Products Contec
Contec programmable Remote I/o Coupler Unit (software Plc Type) Cpsn-pcb271-s1-041
Contec remote I/o Coupler Unit (ethernet/ip Adapter) Cpsn-eob471ei-[]1
Contec remote I/o Coupler Unit (server Type) Cpsn-mcb271-*
Type Values Removed Values Added
Title Plaintext Password Storage Allows Credential Theft with Physical Access
Type Values Removed Values Added
Title Plaintext Password Storage in Contec CPSN Series Enables Credential Theft with Physical Access
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Plaintext Password Storage in Contec CPSN Series Enables Credential Theft with Physical Access
Type Values Removed Values Added
Description Plaintext storage of a password issue exists in CONPROSYS nano Series . If this vulnerability is exploited, an attacker with physical access to the product may obtain credentials.
Weaknesses CWE-256
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 4.1, 'vector': 'CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
Earlier changes (1)
Weaknesses
  • CWE-256

    Plaintext Storage of a Password

Sources

Status
PUBLISHED
Assigner
jpcert
Published
Updated
Sep 14, 2026, 11:19 AM
Reserved
Aug 31, 2026, 2:30 AM

View source JSON

Updated
Sep 14, 2026, 11:14 AM

JSON

Status
Deferred
Published
Sep 14, 2026, 7:17 AM
Modified
Sep 16, 2026, 7:27 PM

View source JSON

No data.

Updated
Sep 17, 2026, 7:46 PM

JSON