This vulnerability (CVE-2025-13926) affects Contemporary Controls BASControl20 version 3.1. An attacker capable of intercepting network traffic can use the captured data to forge packets, enabling them to send arbitrary requests to the BASC 20T device. This is a CWE-807 type vulnerability, which involves improper reliance on untrusted inputs, leading to potential unauthorized actions. The CVSS 3.1 base score of 9.8 indicates the vulnerability is exploitable remotely without privileges or user interaction, and it impacts confidentiality, integrity, and availability severely. No patch or official remediation level has been published by the vendor, and the product is not a cloud service, so remediation depends on vendor updates or mitigations.

Successful exploitation allows an unauthenticated remote attacker to send forged packets to the BASControl20 device, potentially leading to full compromise of the device's confidentiality, integrity, and availability. This could disrupt industrial control processes or leak sensitive information handled by the device. The high CVSS score reflects the critical nature of this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, organizations should consider network-level mitigations such as isolating the BASControl20 devices from untrusted networks, using secure network segmentation, and monitoring for suspicious network activity related to the device. Avoid exposing the device to untrusted networks to reduce risk.