CVE-2026-82793

Unrestricted File Upload Causing Arbitrary Code Execution in Contec CAN 2.0B Converter Units

Published Sep 14, 2026 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Description

Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on the product.

Analysis

Technical impact

This vulnerability allows a remote authenticated attacker to upload a specially crafted file with a dangerous type to a Contec CAN‑2‑USB or CAN‑2‑WF Wireless LAN/USB converter. The device accepts and processes the file without validating its content or type, which can lead to arbitrary code execution on the converter. The flaw is classified as CWE‑434. The consequence is a total loss of confidentiality, integrity, and availability of the impacted device.

Affected Systems

Contec Co., Ltd.’s CAN‑2‑USB and CAN‑2‑WF Wireless LAN/USB converter units are affected. No firmware version range is specified in the advisory, meaning all current or older units that have not applied the later firmware release remain vulnerable.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity. The EPSS score is below 1%, suggesting a low probability of exploitation at the present time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote authenticated; an adversary would need valid credentials to access the device endpoint.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Contec Co., Ltd.

CAN-2-WF

unaffected

Version	Status	Constraints
`0`	affected	< 2.20

Contec Co., Ltd.

CAN-2-USB

unaffected

Version	Status	Constraints
`0`	affected	< 2.20

No data.

Vendor Product Versions

Contec

Can-2-usb

Version	Status	Scheme	Platform
`[0,2.20)`	affected	semver	—

Contec

Can-2-wf

Version	Status	Scheme	Platform
`[0,2.20)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest security update for the CAN‑2‑USB and CAN‑2‑WF converters as published by Contec in their security advisory PDF.
Upgrade the firmware on all affected devices to the patched version that eliminates the unrestricted upload flaw.
If possible, disable or restrict remote file upload functionality on the converter to prevent malicious submissions until a patch is available.
Verify that the device’s authentication mechanisms are configured correctly and that only authorized personnel can access the upload interface.
Monitor device logs for unauthorized upload attempts and investigate any anomalous activity.

Generated by OpenCVE AI on September 15, 2026 at 14:53 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.631% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://jvn.jp/en/vu/JVNVU90314828/
https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_ph_26091000_en.pdf

History

Sep 17, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Contec Contec can-2-usb Contec can-2-wf
Vendors & Products		Contec Contec can-2-usb Contec can-2-wf

Sep 15, 2026 3:15 PM Title updated View changes

Type	Values Removed	Values Added
Title		Unrestricted File Upload Causing Arbitrary Code Execution in Contec CAN 2.0B Converter Units

Sep 14, 2026 10:00 PM Title updated View changes

Type	Values Removed	Values Added
Title	Unrestricted File Upload Leading to Remote Code Execution in Contec CAN 2.0B Converters

Sep 14, 2026 12:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 14, 2026 10:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Unrestricted File Upload Leading to Remote Code Execution in Contec CAN 2.0B Converters

Sep 14, 2026 7:00 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on the product.
Weaknesses		CWE-434
References		https://jvn.jp/en/vu/JVNVU90314828/ https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_ph_26091000_en.pdf
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`