As mentioned, due to the fact M are still supporting these radios they are a little protective of certain softwares and secrets. I've been in the can for just requesting breadcrumbs on these (which I understand and will not dispute).
During my searching (LOTS AND LOTS of it) I found a nice version of something that someone fixed when they've had a similar issue it seems but that's about as far as it could be told. I guess the best search would be "Motorola XTS CPS no password" ?? (hoping that is not beyond the limit of coverage here.... scold me if it is) A few have found a way around it and there was a video I watched just today of someone using wireshark on a MotoTRBO, not sure if that would also work on the XTS?
The issue is Microsoft, Apple etc are pussycats on piracy and secrets compared with Moto that I've experienced at least. Moto has teeth and will use so most are afraid to overstep their mark.