XING CPTrans‑ME‑X is vulnerable to a Use of Default Password (CWE-1393). Attackers who know the factory‑set credentials can authenticate to the device and gain full administrative control. The flaw allows an attacker to modify device settings, disable its operation, or interfere with the fire system monitored by the panel, thereby compromising confidentiality, integrity or availability of the associated fire alarm infrastructure.

The affected product is the XING CPTrans‑ME‑X rack‑mounted control panel manufactured and distributed by Xing Inc. No specific firmware or hardware versions are listed in the advisory, so the vulnerability applies to all devices still configured with the default credentials.

With a CVSS score of 9.3 the vulnerability is classified as Critical, indicating significant impact when exploited. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is remote or local access to the device’s administrative interface using the unchanged default credentials, which an attacker can obtain by knowing or guessing the factory passwords.