CPTrans-ME-X EUVD-2026-70916

The attacker only needs network reachability to the CPTrans-ME-X management/control interface - per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) there is no authentication, no user interaction, and no special configuration required to inject OS commands. The primary limiting factor is exposure: the device is specialized JOYSOUND AV rack hardware typically deployed in venue back-of-house networks and not normally internet-facing, so exploitation depends on the attacker gaining access to the same network segment or the interface being improperly exposed. Exact firmware versions and the specific vulnerable endpoint are not enumerated in the available data.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes the worst realistic case: network-reachable, low-complexity, no authentication, no user interaction, and total system impact - consistent with unauthenticated RCE-grade command injection and an appropriate 9.3 rating. Exploitation-probability signals are limited: there is no EPSS score in the input, the device is not in CISA KEV (no confirmed active exploitation), and no public PoC is referenced, so the score reflects potential rather than observed exploitation. The dominant risk-limiting factor is exposure rather than difficulty - this is niche AV/karaoke rack hardware with a small deployment footprint that is not normally internet-facing, so real-world risk hinges on whether the management interface is network-reachable; any operator running one should treat this as urgent and verify the device is not exposed. Where the device is segmented behind a management VLAN the practical attack surface shrinks dramatically despite the AV:N rating.

An attacker who can reach the CPTrans-ME-X management interface over the network sends a crafted request whose parameter embeds shell metacharacters, and the device passes it unsanitized to an OS command, executing attacker-supplied commands. Because no authentication or user interaction is required, a single request can yield command execution with the privileges of the handling process, enabling full device takeover. No public PoC is referenced at time of analysis.