OS Command Injection Vulnerability in XING CPTrans-ME-X Product
CVE-2026-62928

9.3CRITICAL

Key Information:

Vendor

Xing Inc.

Status
Xing Cptrans-me-x
Vendor
CVE Published:
4 September 2026

What is CVE-2026-62928?

The XING CPTrans-ME-X product is vulnerable to OS Command Injection, allowing unauthorized users to inject malicious commands into the system. This vulnerability exposes the device to potential exploits whereby attackers could manipulate system commands without proper authentication, highlighting the need for immediate remediation to safeguard against unauthorized command execution.

Affected Version(s)

XING CPTrans-ME-X 0 < 1.8.1.17

References

https://joysound.biz/product/other/rack_accessories/cptra...
https://jvn.jp/en/jp/JVN32505330/

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.