Description

XG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the sensitive information stored in the system where XG VisionTerminal or XG-X VisionTerminal is installed may be disclosed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-03T13:06:15.910Z",
  "pubdate": "2026-09-03T13:06:15.910Z",
  "executiveSummary": "The vulnerability identified in Keyence Corporation's XG VisionTerminal and XG-X VisionTerminal is classified as an XML External Entity (XXE) injection flaw.\nThis security defect exists due to improper input validation and insecure configuration of the XML parser when processing user-supplied setting files.\nAn unauthenticated or local attacker can exploit this vulnerability by crafting a malicious XML file designed to trigger an external entity reference.\nSuccessful exploitation permits the unauthorized disclosure of sensitive information residing on the host filesystem, potentially including configuration data, credentials, or system files accessible by the application process.\nThe risk is primarily tied to the application's ability to parse arbitrary XML content, which could lead to server-side request forgery (SSRF) or arbitrary file read operations.\nThe impact depends heavily on the privilege level of the user executing the VisionTerminal software, as the process will attempt to access external resources or files based on the context of the running application.\nThis vulnerability poses a significant risk to the confidentiality of operational and configuration data within the industrial environment where the VisionTerminal software is deployed.",
  "technicalDetails": "The root cause of this vulnerability is the insecure configuration of the XML parser utilized by XG VisionTerminal and XG-X VisionTerminal when reading setting files. The XML processor is configured to resolve external entities defined within the Document Type Definition (DTD) of an XML document.\nWhen the software loads a user-provided setting file, it fails to explicitly disable the resolution of external entities. An attacker can define a custom DTD containing an ENTITY declaration that points to a local file path (e.g., file:///etc/passwd or system configuration files) or an external URI.\nThe attack flow begins when an attacker creates a malicious setting file incorporating a doctype declaration. Within the internal subset of the DTD, the attacker includes a reference to an external entity, such as <!ENTITY xxe SYSTEM 'file:///c:/sensitive_data.txt'>.\nOnce the attacker tricks a user into importing or opening this crafted file, the XML parser attempts to resolve the external entity during the parsing process. Because the parser is not hardened, it follows the reference and retrieves the contents of the target resource.\nThe retrieved content is then incorporated into the application's internal memory or rendered in the application's interface, allowing the attacker to exfiltrate the file content. If the URI points to an external server controlled by the attacker, the application may inadvertently make an outbound HTTP request, which can be used to scan internal network services or bypass local firewalls.\nThis vulnerability does not require prior authentication to the system, provided the attacker can convince a target user to load a malicious setting file. The impact is dictated by the operating system permissions assigned to the user running the VisionTerminal application. If the process runs with administrative or elevated privileges, the attacker can access sensitive system files that would otherwise be restricted.\nThere are no specific conditions mentioned regarding versioning, implying that current iterations of the software using the vulnerable XML parsing library are affected. The attack is effective because the application implicitly trusts the structure of the configuration file and does not implement a secure 'sandbox' or entity-disabled parsing mode for XML inputs."
}