XG VisionTerminal, XG‑X VisionTerminal, LJ Series Terminal‑Software and WI Series Terminal‑Software from Keyence Corporation allow XML external entity references in setting files. A specially crafted setting file can cause the device to resolve external entities, exposing sensitive information stored in the host system. This flaw enables an attacker to read host files and expose confidential data, creating an information disclosure risk classified as CWE‑611.

The affected devices are Keyence Corporation’s XG VisionTerminal, XG‑X VisionTerminal, LJ Series Terminal‑Software and WI Series Terminal‑Software. The advisory does not list any specific firmware or software version, indicating that all current installations may be vulnerable until a patch is released.

The CVSS score is 6.7, indicating a moderate severity level of the potential impact if exploited, but the EPSS score of 0.00186 (approximately 0.186%) indicates a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered by parsing a vulnerable XML setting file, the attack vector is most likely local or requires the attacker to supply a file to the device, such as through an administrative interface or file transfer. If the device accepts externally supplied setting files, a remote attacker might exploit the XXE to read system files.