CPTrans-ME-X CVE-2026-70403

Exploitation requires network reachability to the CPTrans-ME-X management/login interface and knowledge of the hard-coded password embedded in the device firmware; per CVSS AV:N/AC:L/PR:N/UI:N there is no authentication, user interaction, or special runtime configuration needed once the interface is reachable and the credential is known. The primary limiting factors are exposure and secrecy of the credential: the device is a niche AV rack accessory typically deployed on internal/AV networks rather than the public internet, and an attacker must know the fixed credential value (trivially shared across all units once disclosed).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3) describes a remote, low-complexity, unauthenticated attack with full compromise of the vulnerable system and no scope change to other systems - consistent with a network-reachable management login protected only by a fixed secret. No EPSS score, KEV listing, or SSVC decision data was supplied, and no POC reference is present, so real-world exploitation pressure is unquantified from this input. The practical risk hinges on network exposure: the hard-coded credential guarantees trivial access for anyone who learns it, but the product's niche footprint and typical LAN/AV-rack deployment likely limit internet-facing exposure, making this higher risk on flat internal networks than at scale. The 'Authentication Bypass' tag is a loose but defensible characterization of a hard-coded credential.

An attacker on the same network segment as a CPTrans-ME-X device (or one able to route to its management interface) recovers the hard-coded password from firmware or a sibling advisory, then logs in directly without any legitimate account. With full authenticated access they can reconfigure or disrupt the AV signal path and, given the sibling command-injection issue on the same product, potentially pivot to code execution on the device. No user interaction or prior credential theft is required.