Missing authentication in Contec Co., Ltd. Remote I/O Coupler Unit CPSN-MCB271-*
Priority LOW 36CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. An attacker may execute a REST API without authentication, which could allow the attacker to retrieve I/O values and/or control the output.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00341 27th percentileScored 2026-11-07
Fix Fixed Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* (Contec Co., Ltd.): 1.82
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Contec Co., Ltd. | Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* | before 1.82 | 1.82 | Patch available | CNA |
- Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* VendorContec Co., Ltd. Affected before 1.82 Fixed in 1.82 Patch available CNA
Remediation
- Fix · CNA Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* (Contec Co., Ltd.) Fixed in 1.82
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* 1.82
7 records Highest priority Priority LOW 7 LOW
Other records, highest priority first
- TI-2026-57104 Insufficiently protected credentials in Contec Co., Ltd. Remote I/O Coupler Unit…Priority LOW 35
- TI-2026-57103 Stack-based buffer overflow in Contec Co., Ltd. Remote I/O Coupler Unit CPSN-MCB271-*Priority LOW 25
- TI-2026-57100 Out-of-bounds write in Contec Co., Ltd. Remote I/O Coupler Unit CPSN-MCB271-*Priority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2026-82784
- 2026-10-03 Alias added: GHSA-5w7g-j8f5-2795
References
More Contec Co., Ltd. vulnerabilities
- TI-2022-11821 SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php. KEVCVSS 3.1CRITICAL 9.8
- TI-2023-09196 There is a command injection vulnerability in SolarView Compact through 6.00, attackers… CVSS 3.1CRITICAL 9.8
- TI-2022-21852 OS command injection in Contec Co., Ltd. CONPROSYS HMI System CVSS 3.1CRITICAL 9.8
- TI-2023-14072 SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. CVSS 3.1CRITICAL 9.8
- TI-2022-21787 SolarView Compact 4.0 and 5.0 is vulnerable to Unrestricted File Upload via a crafted php file. CVSS 3.1CRITICAL 9.8
- TI-2022-19462 SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-82784 · CVE Program
- CVE-2026-82784 · NVD
- FIRST EPSS
- GHSA-5w7g-j8f5-2795 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences