Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Copeland | XWEB EVO | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 12 Nov 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. | XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it's end of service date in March 2026. |
Thu, 12 Nov 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. | |
| Title | Dixell/Copeland XWEB EVO Predictable Administrator Password Generation | |
| Weaknesses | CWE-330 | |
| References |
|
|
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-12T20:08:44.853Z
Reserved: 2026-11-06T18:38:38.543Z
Link: CVE-2026-124005
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-12T20:18:22.673
Modified: 2026-11-12T20:18:22.673
Link: CVE-2026-124005
Redhat
No data.
OpenCVE Enrichment
No data.