CVE-2026-82774
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 1.19%
- CWE
- CWE-78
- Published
- 2026-09-14
- Last modified
- 2026-09-14
Affected products
- Contec Co., Ltd. M2M Gateway Integrated Type CPS-MG341*
- Contec Co., Ltd. M2M Gateway Configurable type CPS-MGS341*
- Contec Co., Ltd. M2M Controller Integrated Type CPS-MC341
- Contec Co., Ltd. M2M Controller Configurable type CPS-MCS341*
Weakness type
Related vulnerabilities
- CVE-2026-83549 — Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi
- CVE-2026-86152 — Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection
- CVE-2026-82004 — Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- CVE-2026-79724 — Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- CVE-2026-81467 — Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS C
- CVE-2026-71376 — OS Command Injection Vulnerability in Cosminexus Component Container
- CVE-2026-57124 — PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
- CVE-2026-53611 — Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation