CVE-2026-62928
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.
Risk Assessment
Risk of remote execution of arbitrary commands on the device, potentially leading to full compromise of the device and the network it resides in.
Recommendation
Apply vendor patches immediately and restrict network access to the device.
Other vulnerabilities in XING CPTrans-ME-X
See all- CVE-2026-70403Critical
XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.
- CVE-2026-69657Critical
XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.
- CVE-2026-66840High
XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.
Original NVD description (English source)
XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS