CVE-2026-124012: Dixell/Copeland XWEB EVO Hardcoded Administrator Daily Password Authentication Bypass
XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use passwordmode dailypassword with no stored password, as the Users.authenticate function in lualibusers.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026.
Event History
Frequently Asked Questions
Which deployments are exposed?
XWEB EVO devices running versions 5.6.2 through 5.8.8 are affected. The issue is reachable over the network, so devices with web-management access available to an attacker are exposed.
What does an attacker need to exploit this issue?
No prior authentication or user interaction is required. An attacker must be able to derive the device's MAC-based daily password, then can authenticate to the Administrator web account.
What access does successful exploitation provide?
Successful authentication produces a full Administrator session on the device, with impact to confidentiality, integrity, and availability.
Is a normal Administrator password sufficient to prevent exploitation?
The affected Administrator account is configured for daily_password mode without a stored password. Authentication is based on the synthesized daily-password configuration rather than validation of a stored secret.
What should be considered when planning remediation?
The XWEB EVO product line reached end of service in March 2026. Organizations should account for the lack of ongoing service support when planning mitigation or replacement.