Description
Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on the product.
Published: 2026-09-14
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution via unrestricted file upload
Action: Immediate Patch
AI Analysis

Impact

This vulnerability allows a remote authenticated attacker to upload a specially crafted file with a dangerous type to a Contec CAN‑2‑USB or CAN‑2‑WF Wireless LAN/USB converter. The device accepts and processes the file without validating its content or type, which can lead to arbitrary code execution on the converter. The flaw is classified as CWE‑434. The consequence is a total loss of confidentiality, integrity, and availability of the impacted device.

Affected Systems

Contec Co., Ltd.’s CAN‑2‑USB and CAN‑2‑WF Wireless LAN/USB converter units are affected. No firmware version range is specified in the advisory, meaning all current or older units that have not applied the later firmware release remain vulnerable.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity. The EPSS score is below 1%, suggesting a low probability of exploitation at the present time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote authenticated; an adversary would need valid credentials to access the device endpoint.

Generated by OpenCVE AI on September 15, 2026 at 14:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security update for the CAN‑2‑USB and CAN‑2‑WF converters as published by Contec in their security advisory PDF.
  • Upgrade the firmware on all affected devices to the patched version that eliminates the unrestricted upload flaw.
  • If possible, disable or restrict remote file upload functionality on the converter to prevent malicious submissions until a patch is available.
  • Verify that the device’s authentication mechanisms are configured correctly and that only authorized personnel can access the upload interface.
  • Monitor device logs for unauthorized upload attempts and investigate any anomalous activity.

Generated by OpenCVE AI on September 15, 2026 at 14:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Contec
Contec can-2-usb
Contec can-2-wf
Vendors & Products Contec
Contec can-2-usb
Contec can-2-wf

Tue, 15 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Title Unrestricted File Upload Causing Arbitrary Code Execution in Contec CAN 2.0B Converter Units

Mon, 14 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Title Unrestricted File Upload Leading to Remote Code Execution in Contec CAN 2.0B Converters

Mon, 14 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Title Unrestricted File Upload Leading to Remote Code Execution in Contec CAN 2.0B Converters

Mon, 14 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Description Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on the product.
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Contec Can-2-usb Can-2-wf
cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2026-09-14T11:40:46.929Z

Reserved: 2026-08-31T02:30:58.279Z

Link: CVE-2026-82793

cve-icon Vulnrichment

Updated: 2026-09-14T11:39:33.673Z

cve-icon NVD

Status : Deferred

Published: 2026-09-14T07:17:21.480

Modified: 2026-09-16T19:27:25.623

Link: CVE-2026-82793

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T19:45:34Z

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type