Contec vulnerabilities
47 vulnerabilities
Known vulnerabilities in Contec products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 28 products.
Products
28- Sv Cpt Mc31019 vulnerabilities
- Conprosys Hmi System15 vulnerabilities
- Solarview Compact7 vulnerabilities
- Sv Cpt Mc310F6 vulnerabilities
- Cps Mc341 A1 1113 vulnerabilities
- Cps Mc341 Adsc1 1113 vulnerabilities
- Cps Mc341 Adsc1 9313 vulnerabilities
- Cps Mc341 Adsc2 1113 vulnerabilities
- Cps Mc341 Ds1 1113 vulnerabilities
- Cps Mc341 Ds11 1113 vulnerabilities
- Cps Mc341 Ds2 9113 vulnerabilities
- Cps Mc341G Adsc1 1103 vulnerabilities
- Cps Mc341Q Adsc1 1113 vulnerabilities
- Cps Mcs341 Ds1 1113 vulnerabilities
- Cps Mcs341 Ds1 1313 vulnerabilities
- Cps Mcs341G Ds1 1303 vulnerabilities
- Cps Mcs341G5 Ds1 1303 vulnerabilities
- Cps Mcs341Q Ds1 1313 vulnerabilities
- Cps Mg341 Adsc1 1113 vulnerabilities
- Cps Mg341 Adsc1 9313 vulnerabilities
- Cps Mg341G Adsc1 1113 vulnerabilities
- Cps Mg341G Adsc1 9303 vulnerabilities
- Cps Mg341G5 Adsc1 9313 vulnerabilities
- Fxa20002 vulnerabilities
- Fxa30002 vulnerabilities
- Fxa30202 vulnerabilities
- Fxa32002 vulnerabilities
- Conprosys HMI System(Chs)1 vulnerabilities
CVE-2021-20659contec co., ltd.solarview compact+1
EPSS score2.13%
SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to upload arbitrary files via unspecified vectors. If the file is PHP script, an attacker may execute arbitrary code.CVE-2021-20661contec co., ltd.solarview compact+1EPSS score2.47%
Directory traversal vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.CVE-2021-20662contec co., ltd.solarview compact+1EPSS score2.09%
Missing authentication for critical function in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to alter the setting information without the access privileges via unspecified vectors.CVE-2021-20656contec co., ltd.solarview compact+1EPSS score1.15%
Exposure of information through directory listing in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to obtain the information inside the system, such as directories and/or file configurations via unspecified vectors.CVE-2021-20658contec co., ltd.solarview compact+1EPSS score3.68%
SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to execute arbitrary OS commands with the web server privilege via unspecified vectors.CVE-2021-20660contec co., ltd.solarview compact+1EPSS score47.04%
Cross-site scripting vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to inject an arbitrary script via unspecified vectors.CVE-2021-20657contec co., ltd.solarview compact+1EPSS score2.83%
Improper access control vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to obtain and/or alter the setting information without the access privilege via unspecified vectors.CVE-2025-34081contec co.,ltd.conprosys hmi system (chs)+1EPSS score0.68%
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attacker.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.CVE-2025-34080contec co.,ltd.conprosys hmi system (chs)+1EPSS score1.26%
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable to Cross-Site Scripting (XSS) in the getqsetting.php functionality that could allow reflected execution of scripts in the browser on interaction.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.CVE-2014-2324contecsv-cpt-mc310_firmware+7EPSS score29.52%
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.CVE-2022-40881contecsolarview_compact_firmwareEPSS score30.11%
SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.phpCVE-2022-31374contecsv-cpt-mc310_firmwareEPSS score2.43%
An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a crafted php file.CVE-2022-31373contecsv-cpt-mc310_firmwareEPSS score5.56%
SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php.CVE-2022-36158contecfxa2000_firmware+3EPSS score1.57%
Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).CVE-2022-36159contecfxa2000_firmware+3EPSS score1.04%
Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. As the password strength is weak, it can be cracked in few minutes. Through this credential, a malicious actor can access the Wireless LAN Manager interface and open the telnet port then sniff the traffic or inject any malware.CVE-2022-29302contecsv-cpt-mc310_firmwareEPSS score0.33%
SolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/Solar_Ftp.php.CVE-2022-29303contecsv-cpt-mc310_firmwareKEVEPSS score98.04%
SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.CVE-2022-29298contecsv-cpt-mc310_firmwareEPSS score46.80%
SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.CVE-2022-44354contecsolarview_compact_firmwareEPSS score1.58%
SolarView Compact 4.0 and 5.0 is vulnerable to Unrestricted File Upload via a crafted php file.CVE-2022-44456contec co., ltd.conprosys hmi system (chs)+1EPSS score69.88%
CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request.