Description

Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or altered by an attacker who can access the product via FTP.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-14T07:17:17.553Z",
  "pubdate": "2026-09-14T07:17:17.553Z",
  "executiveSummary": "A path traversal vulnerability has been identified within the Contec FX5000, FX4000, and FX3000 series products. This security flaw originates from insufficient validation of user-supplied input provided via the File Transfer Protocol (FTP) service.\nThe vulnerability allows an unauthenticated or authenticated attacker with network access to the target device to bypass intended directory restrictions. By manipulating file paths, an adversary can traverse outside of the designated root directory to access, read, or modify arbitrary files located elsewhere on the system filesystem.\nThe impact of this vulnerability is severe, as it grants unauthorized read and write access to sensitive configuration files, system binaries, or stored data. Successful exploitation could lead to full system compromise, information disclosure, or persistent disruption of service. Mitigation requires restricting network access to the FTP service and verifying if vendor-provided firmware updates address the underlying input sanitization issues.",
  "technicalDetails": "The vulnerability is categorized as a path traversal flaw (CWE-22) residing in the FTP implementation of the Contec FX series. The root cause lies in the application's failure to properly sanitize input parameters associated with file path navigation commands. When processing requests over the FTP protocol, the system does not adequately filter or validate character sequences such as '../' (dot-dot-slash) used to escape the intended directory structure.\nAn attacker can exploit this by injecting traversal sequences into the paths defined in FTP commands, such as RETR (retrieve) or STOR (store). By sending a specially crafted request, the attacker can break out of the chroot or sandboxed environment typically assigned to the FTP user, allowing the process to access restricted files located in system directories or other protected partitions.\nThe attack flow follows these steps: First, the attacker establishes a connection to the affected device using the standard FTP service. Second, the attacker issues file operations using path traversal strings as arguments. Third, the FTP service processes these paths without verifying if the resulting absolute path resides within the authorized storage volume. Fourth, the server executes the read or write operation on the requested arbitrary file, depending on the command used.\nPost-exploitation impact includes the ability to exfiltrate sensitive configuration files that may contain credentials or internal network details. Furthermore, the ability to write to arbitrary files provides a vector for code execution or system modification, such as overwriting system configuration files or binary executables, leading to total system instability or remote control of the device. This vulnerability affects the FX5000, FX4000, and FX3000 series, specifically impacting the logic governing file system interaction via the FTP service."
}