CVE-2026-124011: Dixell/Copeland XWEB EVO Information Disclosure via sysinfo.lua
XWEB EVO 5.6.2 through 5.8.8 contain an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device.
Other sources
XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.
— NVD
Event History
Frequently Asked Questions
Which deployments are exposed?
XWEB EVO devices running versions 5.6.2 through 5.8.8 are affected. The issue is reachable remotely because the vulnerable sysinfo.lua endpoint can be accessed without authentication.
What does an attacker need to exploit this issue?
An attacker does not need credentials or user interaction. They need network access to the device’s sysinfo.lua endpoint, from which they can obtain the eth0 MAC address and system clock needed to derive the daily password offline.
How can I determine whether a device may be affected?
Check whether the device is an XWEB EVO system running a version from 5.6.2 through 5.8.8. A device for which sysinfo.lua is reachable before authentication may disclose the MAC address and system clock used in the daily-password derivation.
What should be considered if patching is not immediately possible?
Restrict network access to the device so unauthenticated parties cannot reach sysinfo.lua or the pre-login interface. The product line reached end of service in March 2026, so organizations should account for the lack of ongoing support when planning remediation.