What is the CVSS score of EUVD-2026-70918?

EUVD-2026-70918 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate EUVD-2026-70918?

Within 24 hours: immediately change the default administrative password on all CPTrans-ME-X devices in your environment and secure the new credentials in your access management system; perform a complete inventory of affected equipment to document location and operational criticality. Within 7 days: implement network segmentation to isolate CPTrans-ME-X devices from general-access networks and restrict all remote management access to authorized administrative subnets via firewall rules; disable unnecessary remote access services if not operationally required; review access logs for evidence of unauthorized activity. Within 30 days: establish ongoing monitoring for vendor security advisories from XING/JOYSOUND; if no patch timeline is disclosed by the vendor, conduct a formal assessment of alternative transmission equipment solutions; perform a retrospective audit of all configuration changes and access attempts on these devices since initial deployment to detect compromise.

CPTrans-ME-X EUVD-2026-70918

Q: Which versions of CPTrans-ME-X are affected by EUVD-2026-70918?

XING's CPTrans-ME-X commercial audio/video transmission equipment contains a shipped default password granting unauthenticated remote administrative access, affecting all firmware revisions without…. A patch is available.

| CVE-2026-69657 CRITICAL

Use of Default Password (CWE-1393)

2026-09-04 jpcert

GHSA-6wxx-c57w-qmvf

Xing Cptrans Me X Xing Inc

9.3

CVSS 4.0 · Vendor: jpcert

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach device management interface over network
Delivery

Submit default credential at login
Exploit

Authenticate as privileged operator
Execution

Alter configuration or disrupt AV service
Impact

Full device compromise / pivot

Vulnerability Assessment

Weakness	CWE CWE-1393 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Default password prevention
Exploitation Conditions	Exploitation requires network access to the CPTrans-ME-X login/management interface and knowledge of the device's default password; no prior authentication, user interaction, or special configuration is needed (AV:N/AC:L/PR:N/UI:N). What limits real-world exploitation is exposure and configuration: the device must be network-reachable to the attacker, and any operator who has already changed the default credential is not affected. Because it is a niche Japanese commercial AV appliance typically deployed on internal/venue networks, internet-facing exposure is expected to be limited.
Impact	The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H = 9.3) describes network-reachable, low-complexity, unauthenticated abuse yielding full compromise - internally consistent for a default-credential login. Weighing real-world signals: there is no EPSS score, no KEV listing, and no POC in the provided data, so exploitation is not confirmed as widespread or automated. However, default-credential flaws are among the easiest to weaponize and are commonly targeted by opportunistic scanning once the credential is public. The dominant limiting factor is exposure and prevalence rather than technical difficulty: CPTrans-ME-X is a niche, industry-specific device with a small deployment footprint, and network reachability depends on whether the management interface is exposed beyond a trusted LAN. Note the input Tag 'Information Disclosure' understates the impact - VC/VI/VA:H is full compromise (effectively an authentication bypass), not read-only disclosure.
Exploit ScenarioDerived	An attacker who has network reachability to a CPTrans-ME-X management interface - via internet exposure or a foothold on the same LAN - connects and authenticates using the publicly known default credential, requiring no exploit tooling. Once logged in, the attacker has full operator control to alter configuration, disrupt the AV service, or pivot within the network. No public POC is currently identified, but the attack requires only knowledge of the credential.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 04, 2026

Unauthenticated remote device takeover in XING (XING Inc./JOYSOUND) CPTrans-ME-X arises from a shipped default password (CWE-1393) that anyone aware of the credential can use to log in with full privileges. The flaw affects all firmware revisions of this Japanese commercial audio/video rack transmission accessory and grants complete control over confidentiality, integrity, and availability. No public exploit code has been identified, and it is not on CISA KEV, but the trivial nature of default-credential abuse makes exploitation straightforward once the credential is known.

Earlier versions of this analysis (1)

v1 Sep 04, 2026 - 07:18 CVSS 9.8

Full device takeover of XING Inc.'s CPTrans-ME-X audio/video transmission appliance is possible because the device ships with a built-in default password (CWE-1393); anyone who knows the documented credential can log in and gain complete control. The flaw was coordinated through JPCERT/CC (JVN32505330) and carries a CVSS 9.8. There is no public exploit identified at time of analysis, but default-credential abuse requires no exploit code - only knowledge of the shipped password.

RemediationAI

No vendor-released patch version is identified in the available data; consult the JPCERT/JVN advisory at https://jvn.jp/en/jp/JVN32505330/ and the vendor page https://joysound.biz/product/other/rack_accessories/cptrans-me-x for firmware or configuration guidance. As the primary compensating control, change the default password immediately to a strong unique credential on every deployed unit - the trade-off is minimal and this directly closes the flaw if the device permits credential changes. Additionally, restrict management access by placing the device on an isolated management VLAN and blocking its administrative interface from untrusted networks and the internet (trade-off: remote administration must be done from the trusted segment or via VPN), and monitor authentication logs for logins using the factory credential.

Affected VersionsENISA

XING CPTrans-ME-X 0 <1.8.1.17

Affected Packages

euvd xing_cptrans_me_x fix: 1.8.1.17

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CPTrans-ME-X is a networked rack accessory in XING Inc.'s JOYSOUND commercial karaoke/AV product line (per the joysound.biz product reference). CPE cpe:2.3:a:xing_inc.:xing_cptrans-me-x:*:*:*:*:*:*:*:* indicates all versions are in scope with no version boundary published. The root cause is CWE-1393 (Use of Default Password): the device ships with a factory-set login credential that is either not required to be changed or is documented/derivable, so any party with that credential authenticates as a legitimate operator. This is distinct from a hard-coded/undocumented backdoor (CWE-259) - the credential is a default that administrators are expected, but not forced, to change.

Know when Xing Cptrans Me X gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (jpcert) PRIMARY 9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 9.8 CRITICAL

Default password permits unauthenticated network login granting full operator control, so PR:N/AC:L with C/I/A all High; scope unchanged as impact stays within the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Sep 04, 2026 - 08:01 EUVD

Analysis Updated

Sep 04, 2026 - 07:29 vuln.today

v2 - CVSS changed

CVSS changed

Sep 04, 2026 - 07:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

CVE Published

Sep 04, 2026 - 06:31 cve.org

CRITICAL 9.8

DescriptionCVE.org

XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.

Executive ViewAI

Why It Matters

XING's CPTrans-ME-X commercial audio/video transmission equipment contains a shipped default password granting unauthenticated remote administrative access, affecting all firmware revisions without vendor patch availability. Attackers aware of the credential gain complete control over transmitted content and device operations, creating immediate risk of broadcast manipulation, service interruption, and network compromise. Organizations relying on this equipment for AV distribution face critical operational vulnerability with no upgrade path.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Enforce strict network segmentation isolating CPTrans-ME-X devices to authorized administrative subnets only; implement firewall rules blocking all non-essential inbound connections; disable remote management capabilities if operationally feasible; deploy network monitoring and alerting to detect unauthorized access attempts; maintain comprehensive audit logging of all access and configuration changes; restrict physical network access to authorized personnel only; require out-of-band validation before executing any configuration changes on these devices.

Threat Intelligence Overview

EPSS Score

0.3%

Top 79% exploitable

Prevalence

Rare

niche Japanese JOYSOUND commercial AV rack accessory, tiny footprint

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.