CVE-2026-82775: CONPROSYS M2M Directory Listing Vulnerability

CVE-2026-82775 Overview

CVE-2026-82775 is an information exposure vulnerability affecting CONTEC CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series devices. The flaw stems from improper access controls on a specific URL path, which allows directory contents to be enumerated over the network. A remote attacker can access the listing without authentication, revealing files and paths intended to remain private. The issue is classified under [CWE-548] Exposure of Information Through Directory Listing. Successful enumeration can expose configuration data, application paths, or other resources that assist follow-on attacks against industrial machine-to-machine (M2M) gateways.

Critical Impact
Remote unauthenticated attackers can enumerate directory contents on affected CONPROSYS M2M devices, disclosing files and paths that can be leveraged for further reconnaissance and targeted exploitation of industrial control assets.

Affected Products

CONTEC CONPROSYS M2M Gateway Series
CONTEC CONPROSYS M2M Controller Series
Specific firmware versions are enumerated in the vendor advisory

Discovery Timeline

2026-09-14 - CVE-2026-82775 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in the NVD database

Technical Details for CVE-2026-82775

Vulnerability Analysis

The vulnerability is an information disclosure issue in the web-facing interface of CONPROSYS M2M Gateway and Controller devices. Requesting a specific URL returns a directory listing of server-side files instead of a controlled response. No authentication is required to trigger the behavior, and no user interaction is needed. Directory listings on embedded industrial devices commonly expose backup files, log files, configuration snippets, and script paths. Attackers use this metadata to identify additional endpoints, credentials, or vulnerable components. The vulnerability itself does not modify system state or interrupt device availability, but it materially lowers the barrier for follow-on exploitation of the same device or adjacent operational technology (OT) assets.

Root Cause

The web server component ships with directory indexing enabled or lacks an index file for a reachable path. When the client requests that path, the server autogenerates and returns an HTML listing of the directory contents. This is a classic [CWE-548] misconfiguration where files not explicitly linked from the application become discoverable through simple HTTP requests. In embedded product firmware, such defaults often persist because deployments assume network-level isolation that does not exist in practice.

Attack Vector

Exploitation requires only network access to the device's HTTP interface and knowledge of the affected URL. An attacker issues an unauthenticated HTTP GET request to the specific path referenced in the vendor advisory. The server responds with an index of files, which the attacker parses to build a map of accessible resources. From that map, attackers pivot to fetching individual files, harvesting credentials, or fingerprinting the exact firmware for use with other known vulnerabilities.

No verified exploit code is available. Refer to the JVN Security Advisory and the Contec Security Document for the specific URL path and affected firmware versions.

Detection Methods for CVE-2026-82775

Indicators of Compromise

Unauthenticated HTTP GET requests to the specific URL identified in the CONTEC advisory returning HTML directory index responses
Repeated sequential file requests from a single external source following an initial listing request
Access log entries from non-management IP ranges targeting the device web interface

Detection Strategies

Inspect device HTTP access logs for responses whose bodies contain directory index markers such as Index of /
Alert on any web request to the affected CONPROSYS management interface originating from outside a defined engineering workstation allowlist
Correlate HTTP reconnaissance activity against CONPROSYS devices with subsequent authentication attempts or configuration changes

Monitoring Recommendations

Forward CONPROSYS device web logs into a centralized SIEM or data lake for retention and querying
Baseline normal HTTP request patterns to M2M gateways and flag deviations, particularly unauthenticated requests
Monitor north-south and east-west network flows to industrial network segments hosting CONPROSYS devices

How to Mitigate CVE-2026-82775

Immediate Actions Required

Restrict network access to CONPROSYS M2M Gateway and Controller web interfaces using firewalls or access control lists so only authorized engineering hosts can connect
Apply the firmware update or configuration change described in the CONTEC advisory as soon as the maintenance window permits
Review web server access logs for prior unauthenticated requests to the vulnerable URL and treat any hits as reconnaissance events

Patch Information

CONTEC has published guidance in the Contec Security Document referenced by JVN VU#96551518. Consult the vendor document for the specific fixed firmware versions and update procedures for each affected model.

Workarounds

Place CONPROSYS devices behind a VPN or jump host and block direct exposure of the HTTP interface to untrusted networks
Disable directory indexing on the web server component if the device configuration permits it prior to firmware update
Segment operational technology networks so that M2M gateways are not reachable from general IT or internet-facing zones

bash

# Example iptables rule restricting CONPROSYS web UI (TCP/80) to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP