Path Traversal in Contec Industrial Controllers via FTP

CVE-2026-82765 is a path traversal vulnerability affecting Contec's FX-series programmable logic controllers (PLCs)—the FX5000, FX4000, and FX3000 lines. This vulnerability allows attackers with FTP access to traverse directory structures and read or modify arbitrary files on the controller's filesystem. For industrial organizations relying on these controllers for critical operations, this represents a significant risk: an attacker could exfiltrate configuration files, modify control logic, or inject malicious code into the device's memory. The vulnerability is particularly concerning because FTP is often exposed on operational technology (OT) networks where security controls may be less mature than in IT environments, and because PLCs typically run continuously without frequent patching cycles.

While Casky currently shows 0 matching skills for this specific CVE, the underlying attack pattern aligns with MITRE ATT&CK's CWE-23 (Relative Path Traversal) behavior—a technique practitioners should monitor across all file-access interfaces. Organizations using Claude AI and extended reasoning through Casky can develop custom detection rules by analyzing FTP command sequences that include path manipulation characters (../, ..\, or encoded equivalents) targeting sensitive directories like firmware or configuration stores. Practitioners would observe this as suspicious FTP activity in network logs: LIST or RETR commands with traversal payloads, followed by STOR or DELE operations. Building detection around these behavioral patterns—rather than CVE-specific signatures—enables defense-in-depth for legacy industrial systems where vendor patches may lag behind threat disclosure.