CVE-2026-124004: Dixell/Copeland XWEB Hardcoded Administrator Backdoor Password
XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application.
Event History
Frequently Asked Questions
Which deployments are exposed?
XWEB EVO deployments running a version before 5.6.2 are affected. Because exploitation is remote and requires no authentication or user interaction, any reachable vulnerable instance should be treated as exposed.
What does an attacker need to exploit this issue?
An attacker only needs network access to the XWEB EVO application. They can use the hardcoded credential "xwebevonewgeneration" in a single request to authenticate as the built-in Administrator account.
What access does successful exploitation provide?
Successful exploitation creates a complete Administrator session and gives the attacker full administrative control over the application.
How can I determine whether my instance is vulnerable?
Check the XWEB EVO version in use. Instances before version 5.6.2 are affected; version 5.6.2 is the stated fixed version.