A critical file upload vulnerability in Contec CONPROSYS TM Series devices allows authenticated attackers to achieve remote code execution, posing a significant risk to system integrity.

This flaw involves an unrestricted file upload mechanism (CWE-434) that permits an authenticated user to upload malicious files. By exploiting this, an attacker can trigger arbitrary command execution on the target hardware.

The vulnerability carries a CVSS score of 8.8, reflecting its high severity and potential for full system compromise. Successful exploitation grants an attacker the ability to execute commands with the privileges of the application, potentially leading to unauthorized system control, data manipulation, or complete device takeover. This presents a severe risk to operational continuity and the security of the industrial environment where these devices are deployed.

Immediate Action: Update the affected CONPROSYS TM Series firmware to version 2.19 or later as specified in the official Contec security advisory.

Proactive Monitoring: Review device access logs for unusual file upload activity or unauthorized changes to system configurations.

Compensating Controls: Restrict access to the management interface to trusted administrative networks only and ensure that user accounts follow the principle of least privilege to minimize the potential impact of an account compromise.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability represents a high-priority risk. Administrators should audit all active user accounts to ensure no unauthorized access exists and proceed with the firmware update to version 2.19 immediately to permanently resolve the underlying file upload flaw.