What is the CVSS score of CVE-2026-62928?

CVE-2026-62928 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 1.2%.

How to fix or mitigate CVE-2026-62928?

Within 24 hours, inventory all CPTrans-ME-X deployments, document network connectivity, and implement emergency firewall rules to restrict inbound connections to these devices only from designated administrative networks. Within 7 days, move affected CPTrans-ME-X units to a segregated network segment if continued operation is required, deploy monitoring to detect command injection attempts, and disable remote management features if operationally feasible. Within 30 days, monitor XING Inc.'s security advisories daily for patch availability; if no patch emerges within 30 days, initiate procurement evaluation for replacement products or architectural redesign to eliminate CPTrans-ME-X from network-critical paths.

CPTrans-ME-X CVE-2026-62928

Q: Which versions of CPTrans-ME-X are affected by CVE-2026-62928?

XING Inc.'s CPTrans-ME-X devices can be fully compromised remotely by unauthenticated attackers through OS command injection, granting unrestricted control without credentials.. A patch is available.

EUVD-2026-70916 CRITICAL

OS Command Injection (CWE-78)

2026-09-04 jpcert

GHSA-wvq4-q789-f852

Command Injection Xing Cptrans Me X Xing Inc

9.3

CVSS 4.0 · Vendor: jpcert

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach device management interface
Delivery

Send crafted request with shell metacharacters
Exploit

Injected input passed to OS command
Execution

Execute arbitrary commands unauthenticated
Impact

Full device compromise

Vulnerability Assessment

Weakness	CWE CWE-78 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization OS command sanitization, avoid shell exec MITRE ATT&CK 2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The attacker only needs network reachability to the CPTrans-ME-X management/control interface - per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) there is no authentication, no user interaction, and no special configuration required to inject OS commands. The primary limiting factor is exposure: the device is specialized JOYSOUND AV rack hardware typically deployed in venue back-of-house networks and not normally internet-facing, so exploitation depends on the attacker gaining access to the same network segment or the interface being improperly exposed. Exact firmware versions and the specific vulnerable endpoint are not enumerated in the available data.
Impact	The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes the worst realistic case: network-reachable, low-complexity, no authentication, no user interaction, and total system impact - consistent with unauthenticated RCE-grade command injection and an appropriate 9.3 rating. Exploitation-probability signals are limited: there is no EPSS score in the input, the device is not in CISA KEV (no confirmed active exploitation), and no public PoC is referenced, so the score reflects potential rather than observed exploitation. The dominant risk-limiting factor is exposure rather than difficulty - this is niche AV/karaoke rack hardware with a small deployment footprint that is not normally internet-facing, so real-world risk hinges on whether the management interface is network-reachable; any operator running one should treat this as urgent and verify the device is not exposed. Where the device is segmented behind a management VLAN the practical attack surface shrinks dramatically despite the AV:N rating.
Exploit ScenarioDerived	An attacker who can reach the CPTrans-ME-X management interface over the network sends a crafted request whose parameter embeds shell metacharacters, and the device passes it unsanitized to an OS command, executing attacker-supplied commands. Because no authentication or user interaction is required, a single request can yield command execution with the privileges of the handling process, enabling full device takeover. No public PoC is referenced at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 1.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 04, 2026

Unauthenticated OS command injection in XING Inc.'s CPTrans-ME-X allows remote attackers to inject and execute arbitrary operating-system commands on the device without any credentials. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.3 with full confidentiality, integrity, and availability impact, meaning a successful attacker gains complete control of the affected unit. No public exploit identified at time of analysis, and the device is not listed in CISA KEV.

Earlier versions of this analysis (1)

v1 Sep 04, 2026 - 07:16 CVSS 9.8

Unauthenticated OS command injection in XING's CPTrans-ME-X media/AV appliance lets a remote attacker inject arbitrary operating-system commands without any credentials or user interaction. The flaw (CWE-78) was coordinated through JPCERT/CC and published via JVN (JVN32505330), and carries a critical CVSS 9.8 rating covering full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and the advisory does not name the specific vulnerable endpoint or parameter.

RemediationAI

No vendor-released patch version is identified in the available data; consult the JVN advisory (https://jvn.jp/en/jp/JVN32505330/) and the vendor page (https://joysound.biz/product/other/rack_accessories/cptrans-me-x) for firmware updates and apply the fixed release as soon as XING publishes one. In the interim, the most effective compensating control is network isolation: place the device on a dedicated management VLAN and block its management interface/ports from untrusted networks and the internet (trade-off: remote administration must occur through a jump host or VPN). Restrict access to the control/management endpoint to a small allowlist of administrator IP addresses, and disable or firewall any remote-management service that is not operationally required (trade-off: reduced convenience for distributed sites). Monitor the device for anomalous outbound connections or unexpected process activity that could indicate command execution.

Affected VersionsENISA

XING CPTrans-ME-X 0 <1.8.1.17

Affected Packages

euvd xing_cptrans_me_x fix: 1.8.1.17

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CPTrans-ME-X is a hardware AV/rack accessory in the JOYSOUND product line from XING Inc. (a Japanese vendor). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): user-supplied input reaches an OS shell or command-execution call without proper sanitization or argument separation, so shell metacharacters (e.g. ';', '|', '`', '$()') let an attacker append or substitute commands. The affected CPE is cpe:2.3:a:xing_inc.:xing_cptrans-me-x:*:*:*:*:*:*:*:*, matching all firmware versions listed to date. Such flaws typically live in embedded web management or control interfaces where operator input is passed to system utilities.

Know when Xing Cptrans Me X gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (jpcert) PRIMARY 9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 9.8 CRITICAL

Unauthenticated network-reachable OS command injection with no user interaction yields full C/I/A on the device, so AV:N/AC:L/PR:N/UI:N and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Sep 04, 2026 - 08:01 EUVD

Analysis Updated

Sep 04, 2026 - 07:31 vuln.today

v2 - CVSS changed

CVSS changed

Sep 04, 2026 - 07:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

CVE Published

Sep 04, 2026 - 06:31 cve.org

CRITICAL 9.8

DescriptionCVE.org

XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.

Executive ViewAI

Why It Matters

XING Inc.'s CPTrans-ME-X devices can be fully compromised remotely by unauthenticated attackers through OS command injection, granting unrestricted control without credentials. Any organization operating these devices on networks accessible from untrusted sources faces immediate risk of complete system takeover and potential lateral movement into production infrastructure. Leadership must prioritize containment of affected devices while awaiting patching options.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) network segmentation and firewall ACLs limiting CPTrans-ME-X access to isolated administrative networks only; (2) disable remote management and command execution features where operationally feasible; (3) deploy IDS/IPS rules to detect command injection payloads targeting the device; (4) implement comprehensive logging and alerting on all command execution; (5) operate the device in a segregated DMZ or air-gapped network if not operationally critical; (6) continuous monitoring of XING Inc. advisories for patch announcements.

Threat Intelligence Overview

EPSS Score

1.2%

Top 33% exploitable

Prevalence

Rare

niche Japanese JOYSOUND AV rack accessory, minimal enterprise footprint

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 1.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.