CVE-2026-70403

XING CPTrans-ME-X devices ship with a hard-coded (built-in) password, meaning a fixed credential is embedded in the product rather than uniquely set per installation (CWE-259). An attacker who knows or obtains this credential can authenticate to the device over the network with no privileges and no user interaction, per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). Once logged in, the attacker has high impact on the device's confidentiality, integrity, and availability, such as viewing or modifying its configuration or disrupting its operation, which drives the critical 9.3 CVSS 4.0 score. Affected users are any operators running the XING CPTrans-ME-X device; the advisory data does not specify affected version ranges, so any unit shipped with the built-in credential should be assumed affected. There are no known public proofs of concept, the issue is not in the CISA KEV catalog, and EPSS currently estimates only a 0.3% probability of exploitation within 30 days, indicating no known exploitation at this time.

What to do: Check whether CPTrans-ME-X devices in your environment are reachable from untrusted networks, and restrict management access with firewall rules or ACLs; if the device supports it, change or rotate the built-in password immediately. Watch for a vendor (XING) or JPCERT advisory offering firmware with the hard-coded credential removed or randomized, and upgrade when a fixed version is released. Review device logs for unexpected logins using the built-in account.