CVE-2026-124005: Dixell/Copeland XWEB EVO Predictable Administrator Password Generation
XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization.
Event History
Frequently Asked Questions
Which XWEB EVO versions are affected?
XWEB EVO versions 4.3.0 through 5.8.8 are affected.
What does an attacker need to derive valid Administrator credentials?
An attacker needs the device MAC address and the date. The password can then be computed offline because the generation process does not use a server-side secret.
Does exploitation require an existing account or user interaction?
No. The vulnerability is described as allowing unauthenticated remote attackers to derive Administrator credentials and authenticate without authorization; it does not require user interaction.
How can an organization determine whether a device is at risk?
Identify the installed XWEB EVO version. Devices running versions 4.3.0 through 5.8.8 are affected by the described predictable Administrator code-of-the-day generation.