Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
CVE-2026-82764: Contec RP‑WAH devices can be tricked into unwanted actions
CVE-2026-82764 · published 1 month ago
Summary
The RP‑WAH‑SR1, RP‑WAH‑SR2, RP‑WAH‑SR12, RP‑WAH‑SR22, and ECE1000 products from Contec may let an attacker cause actions on behalf of a logged‑in user by getting them to view a specially crafted web page. This could lead to changes or commands being run without the user’s intent. Protect against it by applying the vendor’s security update or patch and ensure users only access trusted sites while logged in.
What to do
- Update contec co., ltd. rp-wah-sr1 to version 1.03 or later.
- Update contec co., ltd. rp-wah-sr2 to version 1.03 or later.
- Update contec co., ltd. rp-wah-sr12 to version 1.02 or later.
- Update contec co., ltd. rp-wah-sr22 to version 1.02 or later.
- Update contec co., ltd. ece1000 to version 1.02 or later.
- Update contec co., ltd. ece1020 to version 1.02 or later.
- Update contec co., ltd. ecs1020 to version 1.02 or later.
- Update contec co., ltd. remote i/o coupler unit (server type) cpsn-mcb271-* to version 1.82 or later.
- Update contec co., ltd. remote i/o coupler unit (ethernet/ip adapter) cpsn-eob471ei-[]1 to version 1.02 or later.
- Update contec co., ltd. programmable remote i/o coupler unit (software plc type) cpsn-pcb271-s1-041 to version 1.61 or later.
- Update contec co., ltd. pc-helper wireless i/o dio-0404ry-lwf to version 1.01.00 or later.
- Update contec co., ltd. pc-helper wireless i/o dio-0404ry-lwf-us to version 1.01.00 or later.
- Update contec co., ltd. fxa5000 to version 1.12.00 or later.
- Update contec co., ltd. fxa5020 to version 1.12.00 or later.
- Update contec co., ltd. fxa5020-[][] to version 1.12.00 or later.
- Update contec co., ltd. fxe5000 to version 1.12.00 or later.
- Update contec co., ltd. fxe5000-[][] to version 1.12.00 or later.
- Update contec co., ltd. fxs5000-[][] to version 1.12.00 or later.
- Update contec co., ltd. fxs5021 to version 1.12.00 or later.
- Update contec co., ltd. fxe4000 to version 1.14.00 or later.
- Update contec co., ltd. fxe4000-wp to version 1.14.00 or later.
- Update contec co., ltd. fxs4000 to version 1.14.00 or later.
- Update contec co., ltd. fxs4020 to version 1.14.00 or later.
- Update contec co., ltd. fxa3000 to version 1.20.00 or later.
- Update contec co., ltd. fxa3000-[][] to version 1.20.00 or later.
- Update contec co., ltd. fxa3020 to version 1.20.00 or later.
- Update contec co., ltd. fxa3020-[][] to version 1.20.00 or later.
- Update contec co., ltd. fxa3200 to version 1.20.00 or later.
- Update contec co., ltd. fxa3200-[][] to version 1.20.00 or later.
- Update contec co., ltd. fxe3000 to version 1.20.00 or later.
- Update contec co., ltd. fxe3000-[][] to version 1.20.00 or later.
- Update contec co., ltd. fxe3000-wp to version 1.20.00 or later.
- Update contec co., ltd. fxs300[]-cn to version 1.20.00 or later.
- Update contec co., ltd. sga1000 to version 1.02 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| contec co., ltd. | rp-wah-sr1 | < 1.03 |
| contec co., ltd. | rp-wah-sr2 | < 1.03 |
| contec co., ltd. | rp-wah-sr12 | < 1.02 |
| contec co., ltd. | rp-wah-sr22 | < 1.02 |
| contec co., ltd. | ece1000 | < 1.02 |
| contec co., ltd. | ece1020 | < 1.02 |
| contec co., ltd. | ecs1020 | < 1.02 |
| contec co., ltd. | remote i/o coupler unit (server type) cpsn-mcb271-* | < 1.82 |
| contec co., ltd. | remote i/o coupler unit (ethernet/ip adapter) cpsn-eob471ei-[]1 | < 1.02 |
| contec co., ltd. | programmable remote i/o coupler unit (software plc type) cpsn-pcb271-s1-041 | < 1.61 |
| contec co., ltd. | pc-helper wireless i/o dio-0404ry-lwf | < 1.01.00 |
| contec co., ltd. | pc-helper wireless i/o dio-0404ry-lwf-us | < 1.01.00 |
| contec co., ltd. | fxa5000 | < 1.12.00 |
| contec co., ltd. | fxa5020 | < 1.12.00 |
| contec co., ltd. | fxa5020-[][] | < 1.12.00 |
| contec co., ltd. | fxe5000 | < 1.12.00 |
| contec co., ltd. | fxe5000-[][] | < 1.12.00 |
| contec co., ltd. | fxs5000-[][] | < 1.12.00 |
| contec co., ltd. | fxs5021 | < 1.12.00 |
| contec co., ltd. | fxe4000 | < 1.14.00 |
| contec co., ltd. | fxe4000-wp | < 1.14.00 |
| contec co., ltd. | fxs4000 | < 1.14.00 |
| contec co., ltd. | fxs4020 | < 1.14.00 |
| contec co., ltd. | fxa3000 | < 1.20.00 |
| contec co., ltd. | fxa3000-[][] | < 1.20.00 |
| contec co., ltd. | fxa3020 | < 1.20.00 |
| contec co., ltd. | fxa3020-[][] | < 1.20.00 |
| contec co., ltd. | fxa3200 | < 1.20.00 |
| contec co., ltd. | fxa3200-[][] | < 1.20.00 |
| contec co., ltd. | fxe3000 | < 1.20.00 |
| contec co., ltd. | fxe3000-[][] | < 1.20.00 |
| contec co., ltd. | fxe3000-wp | < 1.20.00 |
| contec co., ltd. | fxs300[]-cn | < 1.20.00 |
| contec co., ltd. | sga1000 | < 1.02 |
Original advisory text
Cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product, unintended operations may be performed.
Cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product, unintended operations may be performed.
References
- https://jvn.jp/en/vu/JVNVU90314828/
- https://jvn.jp/en/vu/JVNVU96551518/
- https://jvn.jp/en/vu/JVNVU99009004/
- https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/secur...
- https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/secur...
- https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/secur...
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.1
Medium
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published14 Sep 2026
Updated29 Oct 2026
First seen14 Sep 2026
Track software like this
Free during beta