An OS command injection vulnerability in Contec CONPROSYS M2M gateways and controllers allows authenticated attackers to achieve full system compromise.

This vulnerability is a classic OS Command Injection (CWE-78) flaw triggered by improper neutralization of input elements. An attacker with valid user credentials can exploit this to execute arbitrary commands at the operating system level.

Successful exploitation of this flaw grants an attacker the ability to execute arbitrary OS commands, which typically leads to a full system compromise. Given the CVSS score of 8.8, this vulnerability is classified as High severity because it provides an attacker with significant control over industrial gateway infrastructure. The potential for unauthorized access, data exfiltration, or disruption of critical M2M communication processes poses a severe risk to operational continuity and system integrity.

Immediate Action: Update all affected CONPROSYS M2M Gateway and Controller units to firmware version 4.1.0 or later as specified in the vendor security advisory.

Proactive Monitoring: Monitor system logs for unusual command executions, unexpected process spawns, or unauthorized attempts to access administrative functions by low-privileged users.

Compensating Controls: Restrict network access to the device management interface to trusted IP addresses only and ensure that all user accounts follow the principle of least privilege to limit the impact of a compromised account.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability necessitates immediate attention for all deployments of the Contec CONPROSYS M2M series. Administrators must prioritize updating to version 4.1.0 to eliminate the command injection vector, as the ability to execute OS commands represents an unacceptable security risk to industrial control systems.