fkie_cve-2026-66840

XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.

GHSA-fhhq-q67p-8cvj

XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.

jvndb-2026-000128

CPTrans-ME-X provided by XING Inc. contains multiple vulnerabilities listed below.<a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/497.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/1393.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/259.html' target='_blank'></a><ul><li>OS Command Injection (CWE-78) - CVE-2026-62928</li><ul><li>Improper processing of the input through the administrative port may lead to OS command injection.</li></ul><li>Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) - CVE-2026-66840</li><ul><li>Improper processing of the input through the administrative port may lead to the system information exposure.</li></ul><li>Use of Default Password (CWE-1393) - CVE-2026-69657</li><ul><li>The affected devices with the initial configuration have a default password for the Web UI.</li></ul><li>Use of Hard-coded Password (CWE-259) - CVE-2026-70403</li><ul><li>There is a password embedded in the firmware of the affected devices which allows unauthorized users to log in to the administrative port.</li></ul></ul>Katsuhiko Sato(a.k.a. goroh_kun) of 00One, Inc. reported the issues to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Most recent entries from all

fkie_cve-2026-66840

GHSA-fhhq-q67p-8cvj

jvndb-2026-000128