Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

Contec RP-WAH-SR devices allow injected script in browser

CVE-2026-82769 · published 1 month ago
Summary

The web interface of Contec RP‑WAH‑SR series can run code that an attacker adds. If a logged‑in user visits a manipulated page, the attacker could run any script in that user’s browser, potentially stealing information or changing settings. Apply the vendor’s security update or limit access to trusted users until it is patched.

What to do
  • Update contec co., ltd. rp-wah-sr1 to version 1.03 or later.
  • Update contec co., ltd. rp-wah-sr2 to version 1.03 or later.
  • Update contec co., ltd. rp-wah-sr12 to version 1.02 or later.
  • Update contec co., ltd. rp-wah-sr22 to version 1.02 or later.
Affected software
VendorProductAffected versions
contec co., ltd. rp-wah-sr1 < 1.03
contec co., ltd. rp-wah-sr2 < 1.03
contec co., ltd. rp-wah-sr12 < 1.02
contec co., ltd. rp-wah-sr22 < 1.02
Original advisory text
Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published14 Sep 2026
Updated4 Nov 2026
First seen14 Sep 2026
Sources
CVE-2026-82769 · NVD
CVE-2026-82769 · MITRE
Track software like this
Free during beta