CVE-2026-82791

OS Command Injection Vulnerability in Contec CAN 2.0B Converter Unit

Published Sep 14, 2026 CVSS 4.0 · 8.7 High EPSS 1.9% KEV · Not listed

Description

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

Analysis

Technical impact

The flaw allows an attacker that can log into the device to inject arbitrary operating system commands through unsanitized input. This is a classic OS command injection vulnerability, classified as CWE-78. causing loss of confidentiality, integrity, and availability. The product in question is the Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit, and the advisory does not list affected firmware builds, so all current releases may be vulnerable until a patch is applied.

Affected Systems

The vulnerability affects Contec Co., Ltd.'s CAN-2-USB and CAN-2-WF models. These are adapters that enable CAN 2.0B communication over USB or wireless LAN, respectively. Any installation of these units with Contec's firmware may be susceptible to exploitation.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity, but the EPSS score of 1% reflects low exploitation probability. The vulnerability is not in the CISA KEV catalog, indicating no publicly reported exploitation yet. Nonetheless, because the flaw only requires legitimate credentials, authentication controls remain critical to mitigate risk.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Contec Co., Ltd.

CAN-2-WF

unaffected

Version	Status	Constraints
`0`	affected	< 2.20

Contec Co., Ltd.

CAN-2-USB

unaffected

Version	Status	Constraints
`0`	affected	< 2.20

No data.

Vendor Product Versions

Contec

Can-2-usb

Version	Status	Scheme	Platform
`[0,2.20)`	affected	generic	—

Contec

Can-2-wf

Version	Status	Scheme	Platform
`[0,2.20)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest firmware update provided by Contec to remedy the OS command injection flaw.
Replace default or weak credentials on the device to reduce the likelihood of an attacker gaining authenticated access.
Restrict device connectivity to a trusted management network and enforce strict firewall rules to limit exposure to untrusted hosts.

Generated by OpenCVE AI on September 15, 2026 at 15:39 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.9% (1.868% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://jvn.jp/en/vu/JVNVU90314828/
https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_ph_26091000_en.pdf

History

Sep 17, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Contec Contec can-2-usb Contec can-2-wf
Vendors & Products		Contec Contec can-2-usb Contec can-2-wf

Sep 15, 2026 4:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		OS Command Injection Vulnerability in Contec CAN 2.0B Converter Unit

Sep 14, 2026 9:00 PM Title updated View changes

Type	Values Removed	Values Added
Title	OS Command Injection in Contec CAN‑2‑USB/WF Converter Allowing Remote Command Execution

Sep 14, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 14, 2026 11:00 AM Title updated View changes

Type	Values Removed	Values Added
Title		OS Command Injection in Contec CAN‑2‑USB/WF Converter Allowing Remote Command Execution

Sep 14, 2026 7:00 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
Weaknesses		CWE-78
References		https://jvn.jp/en/vu/JVNVU90314828/ https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_ph_26091000_en.pdf
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`