Contec PC-HELPER: Multiple CVE-2026 (XSS/CSRF/OS Command Injection/File Upload)

Multiple Vulnerabilities in Contec PC-HELPER Series Vulnerability Overview The PC-HELPER series devices provided by Contec Corporation (Contec) contain multiple security vulnerabilities, primarily involving web application security (XSS, CSRF) and operating system command injection. Scope of Impact Affected Systems: CVE-2026-82790, CVE-2026-82764 PC-HELPER firmware version 1.01.00 and earlier PC-HELPER firmware version 1.01.02 and earlier CVE-2026-82791, CVE-2026-82792, CVE-2026-82793 CAN-2 communication unisolated USB hub CAN-2 firmware version 2.20 and earlier CAN-2 USB version 2.20 and earlier Vulnerability Details Cross-Site Scripting (XSS) CVE-2026-82790 CVSS 4.0 Base Score: 4.8 CVSS 3.1 Base Score: 5.4 CVE-2026-82764 CVSS 4.0 Base Score: 5.1 CVSS 3.1 Base Score: 4.3 OS Command Injection CVE-2026-82791 CVSS 4.0 Base Score: 8.7 CVSS 3.1 Base Score: 8.8 Cross-Site Request Forgery (CSRF) CVE-2026-82792 CVSS 4.0 Base Score: 4.8 CVSS 3.1 Base Score: 5.2 Insufficient Validation of Uploaded Files CVE-2026-82793 CVSS 4.0 Base Score: 8.6 CVSS 3.1 Base Score: 7.2 Potential Impact An unauthenticated user can execute arbitrary scripts in a web browser (CVE-2026-82790, CVE-2026-82764). An authenticated user can perform arbitrary operations when accessing specific pages (CVE-2026-82764). An attacker with login access can execute arbitrary OS commands (CVE-2026-82791). An attacker can execute arbitrary code when a web application is uploaded with a tampered form (CVE-2026-82793). Remediation Upgrade Method: Update the firmware web application to the latest version, as specified by the vendor. Reference Link**: Contec Corporation's documentation on vulnerabilities in PC-HELPER series products (PDF).

Goal Reached Thanks to every supporter — we hit 100%!

Contec PC-HELPER: Multiple CVE-2026 (XSS/CSRF/OS Command Injection/File Upload)

More from this source