Quick answers
- Is CVE-2026-66840 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66840 being exploited in the wild.
- How severe is CVE-2026-66840?
- High severity, with a CVSS score of 7.5, published 4 September 2026.
- Which products and versions are affected?
- XING CPTrans-ME-X prior to Ver 1.8.1.17.
- Is there a fix for CVE-2026-66840?
- A patch was published on 2026-04: Firmware update via FOTA implemented in April 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-66840 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-66840?
- Check whether you run XING CPTrans-ME-X at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability (CVE-2026-66840) is an information disclosure flaw (CWE-497) caused by improper input validation on the device's administrative port. An unauthenticated attacker on the network can send specially crafted input to extract sensitive system information without authentication. The attack requires network access to the administrative port but no prior credentials or user interaction. The vulnerability can be exploited remotely to gather intelligence about the affected device's configuration and internals, which may be leveraged for further attacks. A firmware update to version 1.8.1.17 or later fixes this issue by implementing stricter input processing and initially disabling the administrative port by default.
Affected products
- XING CPTrans-ME-X prior to Ver 1.8.1.17
Timeline
- 2026-09-04: disclosed
- 2026-04: patched: Firmware update via FOTA implemented in April 2026