EUVD-2026-70916
GHSA-wvq4-q789-f852
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable OS command injection with no user interaction yields full C/I/A on the device, so AV:N/AC:L/PR:N/UI:N and C/I/A:H.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
6DescriptionCVE.org
XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.
AnalysisAI
Unauthenticated OS command injection in XING Inc.'s CPTrans-ME-X allows remote attackers to inject and execute arbitrary operating-system commands on the device without any credentials. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.3 with full confidentiality, integrity, and availability impact, meaning a successful attacker gains complete control of the affected unit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker only needs network reachability to the CPTrans-ME-X management/control interface - per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) there is no authentication, no user interaction, and no special configuration required to inject OS commands. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes the worst realistic case: network-reachable, low-complexity, no authentication, no user interaction, and total system impact - consistent with unauthenticated RCE-grade command injection and an appropriate 9.3 rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data; consult the JVN advisory (https://jvn.jp/en/jp/JVN32505330/) and the vendor page (https://joysound.biz/product/other/rack_accessories/cptrans-me-x) for firmware updates and apply the fixed release as soon as XING publishes one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all CPTrans-ME-X deployments, document network connectivity, and implement emergency firewall rules to restrict inbound connections to these devices only from designated administrative networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Xing Cptrans Me X
View allUnauthenticated device login in XING Inc.'s CPTrans-ME-X AV signal-transport appliance is possible via a hard-coded pass
Unauthenticated remote device takeover in XING (XING Inc./JOYSOUND) CPTrans-ME-X arises from a shipped default password
Sensitive system information exposure in XING CPTrans-ME-X (a rack-mounted accessory from XING Inc., distributed under t
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today