CVE-2026-124006: Dixell/Copeland XWEB EVO Predictable Root Password Generation
XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system.
Event History
Frequently Asked Questions
Do attackers need an existing account or user interaction to exploit this issue?
No. The CVSS vector specifies no privileges required and no user interaction, and the issue allows unauthorized root access when the deterministic credential is calculated.
Does the per-device password behavior in version 5.7.0 and later prevent exploitation?
No. Before 5.7.0, the root password was identical across all units. From 5.7.0 onward, the daily password is MAC-based but remains derivable, so the root credential can still be calculated.
Which versions should be treated as affected?
XWEB EVO versions through 5.8.8 are affected. Devices running versions before 5.7.0 have the additional exposure of sharing an identical root password across all units.
Is this product line still within its service lifecycle?
No. The XWEB EVO product line reached its end-of-service date in March 2026.