CVE-2026-82762
HighCVSS 8.8Summary
An OS Command Injection issue exists in Contec FX5000 series, FX4000 series, and FX3000 series due to improper neutralization of special elements. An attacker who can log in to the product may execute arbitrary OS commands.
Risk Assessment
This vulnerability allows an authenticated attacker to execute arbitrary OS commands, potentially resulting in full control over the device.
Recommendation
Update Contec FX5000/FX4000/FX3000 series to a patched version and enforce least privilege for accounts that can log in to the product.
Other vulnerabilities in Contec FX5000/FX4000/FX3000 series
See all- CVE-2026-82765High
A path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. An attacker with FTP access to the product may view and/or alter arbitrary files on the server.
- CVE-2026-82763Medium
A cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If exploited, an arbitrary script may be executed in a logged-in user's web browser.
Original NVD description (English source)
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.