CVE-2026-82764
Received Received - Intake

Cross-Site Request Forgery in Contec Products

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: JPCERT/CC

Description
Cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product, unintended operations may be performed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-10-04
AI Q&A
2026-09-14
EPSS Evaluated
2026-10-03
NVD
CVE-2026-82764
EUVD
EUVD-2026-77218

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
contec pc-helper_wireless_i_o_dio-0404ry-lwf to 1.01.00 (exc)
contec pc-helper_wireless_i_o_dio-0404ry-lwf-us to 1.01.00 (exc)
contec conprosys to 1.01.00 (exc)
contec conprosys_nano to 1.01.00 (exc)
contec flexlan to 1.12.00 (exc)
contec flexlan to 1.14.00 (exc)
contec flexlan to 1.02 (exc)
contec pc-helper to 1.01.00 (exc)
contec can_communication_converter to 2.20 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82764 is a cross-site request forgery (CSRF) vulnerability affecting multiple CONTEC CONPROSYS Series products. It allows attackers to trick users into executing unauthorized actions through crafted web requests while logged in to the affected product.

Detection Guidance

Detecting CSRF vulnerabilities typically involves monitoring web traffic for suspicious requests or unauthorized actions. Check web server logs for unusual POST requests or actions performed without user intent. Use tools like Burp Suite or OWASP ZAP to intercept and analyze web traffic for forged requests targeting Contec products.

Impact Analysis

If exploited, this vulnerability could lead to unintended operations being performed on the affected device, such as unauthorized redirections to malicious sites or execution of unwanted actions without the user's knowledge.

Compliance Impact

The provided CVE data does not explicitly address compliance impacts on GDPR or HIPAA. The vulnerability involves cross-site request forgery (CSRF) in Contec products, which could lead to unauthorized actions but lacks direct references to data protection regulations or compliance requirements.

Mitigation Strategies

Update the firmware to the latest version provided by Contec for the affected CONPROSYS Series or PC-HELPER Series products. If updating is not possible, disconnect the product from network lines, install a firewall to allow only trusted communications, and restrict network access to a trusted closed network.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82764. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart