Which versions of CPTrans-ME-X are affected by CVE-2026-69657?

XING's CPTrans-ME-X commercial audio/video transmission equipment contains a shipped default password granting unauthenticated remote administrative access, affecting all firmware revisions without…. A patch is available.

How to fix or mitigate CVE-2026-69657?

Within 24 hours: immediately change the default administrative password on all CPTrans-ME-X devices in your environment and secure the new credentials in your access management system; perform a complete inventory of affected equipment to document location and operational criticality. Within 7 days: implement network segmentation to isolate CPTrans-ME-X devices from general-access networks and restrict all remote management access to authorized administrative subnets via firewall rules; disable unnecessary remote access services if not operationally required; review access logs for evidence of unauthorized activity. Within 30 days: establish ongoing monitoring for vendor security advisories from XING/JOYSOUND; if no patch timeline is disclosed by the vendor, conduct a formal assessment of alternative transmission equipment solutions; perform a retrospective audit of all configuration changes and access attempts on these devices since initial deployment to detect compromise.

CPTrans-ME-X CVE-2026-69657

Q: What is the CVSS score of CVE-2026-69657?

CVE-2026-69657 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-70918 CRITICAL

Use of Default Password (CWE-1393)

2026-09-04 jpcert

GHSA-6wxx-c57w-qmvf

Xing Cptrans Me X Xing Inc

9.3

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Default password permits unauthenticated network login granting full operator control, so PR:N/AC:L with C/I/A all High; scope unchanged as impact stays within the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 04, 2026 - 08:01 EUVD

Metadata Corrected

Sep 04, 2026 - 07:40 vuln.today

tag: Information Disclosure removed

Analysis Updated

Sep 04, 2026 - 07:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 04, 2026 - 07:22 vuln.today

cvss_changed

CVSS changed

Sep 04, 2026 - 07:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Sep 04, 2026 - 07:18 vuln.today

CVE Published

Sep 04, 2026 - 06:31 cve.org

CRITICAL 9.8

DescriptionCVE.org

XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.

AnalysisAI

Unauthenticated remote device takeover in XING (XING Inc./JOYSOUND) CPTrans-ME-X arises from a shipped default password (CWE-1393) that anyone aware of the credential can use to log in with full privileges. The flaw affects all firmware revisions of this Japanese commercial audio/video rack transmission accessory and grants complete control over confidentiality, integrity, and availability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network access to the CPTrans-ME-X login/management interface and knowledge of the device's default password; no prior authentication, user interaction, or special configuration is needed (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H = 9.3) describes network-reachable, low-complexity, unauthenticated abuse yielding full compromise - internally consistent for a default-credential login. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch version is identified in the available data; consult the JPCERT/JVN advisory at https://jvn.jp/en/jp/JVN32505330/ and the vendor page https://joysound.biz/product/other/rack_accessories/cptrans-me-x for firmware or configuration guidance. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: immediately change the default administrative password on all CPTrans-ME-X devices in your environment and secure the new credentials in your access management system; perform a complete inventory of affected equipment to document location and operational criticality. …

Threat intelligence, references, and detailed analysis are available after sign-in.