CVE-2026-82762: Contec FLEXLAN FX5000/FX4000/FX3000 OS command injection via login

CVE-2026-82762 · Severity: high · CVSS 8.8 · Published 2026-09-14

Contec's FLEXLAN series are industrial networking products (routers/gateways) used to connect and manage remote sites. An authenticated attacker who logs into the device's management interface can inject arbitrary operating system commands, potentially taking full control of the device and compromising any systems it protects or connects to.

Vendors: Contec.

Quick answers

Is CVE-2026-82762 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82762 being exploited in the wild.
How severe is CVE-2026-82762?
High severity, with a CVSS score of 8.8, published 14 September 2026.
Which products and versions are affected?
Contec FXA3000 versions prior to 1.20.00; Contec FXA3020 versions prior to 1.20.00; Contec FXA3200 versions prior to 1.20.00; Contec FXA5000 versions prior to 1.12.00; and 10 more.
Is there a fix for CVE-2026-82762?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82762 attacked?
It is attacked over the network.
Am I affected by CVE-2026-82762?
Check whether you run Contec FXA3000, Contec FXA3020, Contec FXA3200 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an OS command injection vulnerability (CWE-78) affecting multiple FLEXLAN product lines. The vulnerability requires authentication to the device's web interface or management system, meaning an attacker must have valid login credentials or bypass authentication. Once authenticated, the attacker can inject specially crafted input into a vulnerable parameter that is passed unsanitized to an OS command execution function, allowing arbitrary command execution with the privileges of the application. The CVSS 8.8 score reflects high impact (confidentiality, integrity, and availability) with low attack complexity but requiring prior authentication. Patches are available from Contec; users should update firmware to FX5000 series v1.12.00 or later, FX4000 series v1.14.00 or later, and FX3000 series v1.20.00 or later.

Affected products

  • Contec FXA5000 versions prior to 1.12.00
  • Contec FXA5020 versions prior to 1.12.00
  • Contec FXE5000 versions prior to 1.12.00
  • Contec FXS5000 versions prior to 1.12.00
  • Contec FXS5021 versions prior to 1.12.00
  • Contec FXE4000 versions prior to 1.14.00
  • Contec FXE4000-WP versions prior to 1.14.00
  • Contec FXS4000 versions prior to 1.14.00
  • Contec FXS4020 versions prior to 1.14.00
  • Contec FXA3000 versions prior to 1.20.00
  • Contec FXA3020 versions prior to 1.20.00
  • Contec FXA3200 versions prior to 1.20.00
  • Contec FXE3000 versions prior to 1.20.00
  • Contec FXE3000-WP versions prior to 1.20.00

Timeline

  • 2026-09-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.