This vulnerability involves an unrestricted file upload flaw in the Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit (CAN-2-WF). A remote attacker with authentication privileges can upload specially crafted files of dangerous types, which may result in arbitrary code execution on the affected product. The CVSS 3.1 base score is 7.2, reflecting high impact on confidentiality, integrity, and availability. The affected versions include all versions from initial release up to but excluding version 2.20.

Successful exploitation allows a remote authenticated attacker to execute arbitrary code on the affected device, compromising confidentiality, integrity, and availability. This could lead to full control over the CAN-2-WF unit, potentially disrupting its operation or allowing further attacks within the network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, restrict access to authenticated users and limit file upload capabilities where possible to reduce risk.