CVE-2026-70403
Received Received - Intake

Hard-coded Password in XING CPTrans-ME-X

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: JPCERT/CC

Description
XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-70403
EUVD
EUVD-2026-70919

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xing_inc cptrans-me-x to 1.8.1.17 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a hard-coded password in XING CPTrans-ME-X software. The password is embedded in the system and cannot be changed, allowing anyone who knows it to log in to the device without authentication.

Detection Guidance

To detect this vulnerability, check if the affected XING CPTrans-ME-X device is running firmware versions prior to Ver 1.8.1.17. Verify if the administrative port is accessible without authentication. Use network scanning tools like nmap to identify open ports and services on the device. Look for default or hard-coded credentials in configuration files or device documentation.

Impact Analysis

An attacker with knowledge of the hard-coded password could gain unauthorized access to the device. This may lead to data breaches, unauthorized control of the system, or disruption of services. The high CVSS scores indicate a critical risk of confidentiality, integrity, and availability compromise.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by allowing unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. The hard-coded password undermines these protections.

Mitigation Strategies

Change the hard-coded password on the affected XING CPTrans-ME-X device to a strong, unique password. Ensure the new password is not reused elsewhere and restrict access to the device.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70403. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart