JVNDB-2026-031532

Multiple Keyence products vulnerable to improper restriction of XML external entity reference

XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation contain the following vulnerability.

• Improper restriction of XML external entity reference (CWE-611) - CVE-2026-82918

Michael Heinzl reported these vulnerabilities to JPCERT/CC.
JPCERT/CC coordinated with the developer.

KEYENCE CORPORATION.

• LJ Series Terminal-Software Ver.2.4.0000 and earlier
• WI Series Terminal-Software Ver.1.1.0000 and earlier
• XG VisionTerminal Ver.5.5.0010 and earlier
• XG-X VisionTerminal Ver.3.6.0000 and earlier

As for the details of how to check the versions, refer to the information provided by the developer.

If a user opens a specially crafted setting file, the sensitive information stored in the system where the affected product is installed may be disclosed.

[Update the software]
Apply the appropriate update according to the information provided by the developer.

• XG-X VisionTerminal Ver.3.7.0000 or above
• LJ Series Terminal-Software Ver.2.4.0002 or above
• WI Series Terminal-Software Ver.1.1.0001 or above

[Upgrade to alternative software]
The developer recommends that the users of XG VisionTerminal should upgrade to XG-X VisionTerminal Ver.3.7.0000 or above since XG VisionTerminal is EOL (end-of-life), therefore no longer supported.

[Apply workaround]
The developer recommends that the users should apply following workaround if applying immediate update or upgrade is difficult.

• Do not open untrusted setting files

For more information, refer to the information provided by the developer.

KEYENCE CORPORATION.

• KEYENCE CORPORATION : Vulnerability to XXE Attack Found in the XG-X VisionTerminal and the XG VisionTerminal
• KEYENCE CORPORATION : Vulnerability to XXE Attack Found in the LJ Series Terminal-Software
• KEYENCE CORPORATION : Vulnerability to XXE Attack Found in the WI Series Terminal-Software

1. Improper Restriction of XML External Entity Reference(CWE-611) [Other]

1. CVE-2026-82918

1. JVN : JVNVU#98062224

• [2026/09/03]
    Web page was published
• [2026/10/08]
    Title was modified
    Overview was modified
    Affected Products : Products were added
    Impact was modified
    Solution was modified
    Vendor Information : Contents were added