JVNVU#98062224
Multiple Keyence products vulnerable to improper restriction of XML external entity reference

Overview

XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML external entity references.

Products Affected

• XG-X VisionTerminal Ver.3.6.0000 and earlier
• XG VisionTerminal Ver.5.5.0010 and earlier
• LJ Series Terminal-Software Ver.2.4.0000 and earlier
• WI Series Terminal-Software Ver.1.1.0000 and earlier

Description

XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation contain the following vulnerability.

• Improper restriction of XML external entity reference (CWE-611)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Base Score 6.7
  • CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Base Score 5.5
  • CVE-2026-82918

Impact

If a user opens a specially crafted setting file, the sensitive information stored in the system where the affected product is installed may be disclosed.

Solution

Update the software
Apply the appropriate update according to the information provided by the developer.

• XG-X VisionTerminal Ver.3.7.0000 or above
• LJ Series Terminal-Software Ver.2.4.0002 or above
• WI Series Terminal-Software Ver.1.1.0001 or above

Upgrade to alternative software
The developer recommends that the users of XG VisionTerminal should upgrade to XG-X VisionTerminal Ver.3.7.0000 or above since XG VisionTerminal is EOL (end-of-life), therefore no longer supported.

Apply workaround
The developer recommends that the users should apply following workaround if applying immediate update or upgrade is difficult.

• Do not open untrusted setting files

For more information, refer to the information provided by the developer.