CVE-2026-69657

XING CPTrans-ME-X devices are affected by a use-of-default-password flaw (CWE-1393): the device accepts login with a factory-set credential that is not unique per installation. An attacker who knows this default credential can authenticate over the network with no prior privileges and no user interaction. Once logged in, the attacker gains full control of the device — the CVSS 4.0 base score of 9.3 reflects high impact to the device's confidentiality, integrity, and availability, meaning it can be reconfigured, tampered with, or disrupted. Any deployed CPTrans-ME-X unit whose default password has not been changed is affected; the available data does not specify affected version ranges or a fixed version. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Immediately change the default password on any CPTrans-ME-X device and verify the factory credential no longer grants access; restrict the device's login/management interface to trusted networks and do not expose it to the internet. Monitor the vendor and JPCERT advisories for a firmware update, since no fixed version is specified in the available data.