This vulnerability involves missing authentication for critical REST API functions in Contec's Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. An attacker can invoke these APIs without any authentication, potentially allowing unauthorized retrieval of I/O values and control over outputs. The affected versions are those before 1.82. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker can remotely access and manipulate the device's I/O values without authentication, leading to potential unauthorized information disclosure and control over device outputs. This could affect the integrity and confidentiality of the system's operations but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device and monitor for unauthorized API usage where possible.