XING CPTrans‑ME‑X contains a hard‑coded password that can be used to authenticate to the device. Anyone who discovers the credential can log in and gain full control of the device. The vulnerability is a classic use of hard‑coded credentials, classified as CWE‑259. The impact is that an attacker can bypass any authentication mechanism and obtain unrestricted access, enabling configuration changes, data exfiltration, or further network attacks.

The affected product is XING CPTrans‑ME‑X from Xing Inc. No specific version information is listed, so any device running the current firmware that contains the hard‑coded password is at risk.

The CVSS base score of 9.3 indicates a high‑severity flaw that could enable remote takeover. The EPSS score is not available, but the lack of a KEV listing does not diminish the risk of exploitation. The likely attack vector is remote authentication over the management interface; the attacker needs only the known credential, and the vulnerability does not require code execution or other prerequisites.