Hardcoded Credential in XWEB EVO

Executive Summary

CVE-2026-124012 is a hardcoded credential vulnerability in XWEB EVO 5.6.2 through 5.8.8 where the Administrator account uses a daily_password mode without a stored password. The system generates the password dynamically from the device's MAC address, allowing attackers who derive this password to authenticate as Administrator and gain full admin access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your XWEB EVO device runs versions 5.6.2 through 5.8.8. Verify if the Administrator account uses daily_password mode without a stored password. Inspect the lualib_users.lua file for the Users.authenticate function behavior. Network scanning tools can identify exposed devices running these versions.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to gain full administrative control over the device, potentially leading to unauthorized access, configuration changes, or disruption of operations. Since the product line is end-of-service, no patches will be available.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access, compromising data confidentiality and integrity. It may violate compliance requirements for access control and audit logging under standards like GDPR and HIPAA, potentially resulting in legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade XWEB EVO devices to a version beyond 5.8.8 if available. If end-of-service prevents updates, isolate affected devices from untrusted networks. Disable remote administrative access and monitor for unauthorized login attempts. Replace the device if no updates are possible.

Useful 0 Not Useful 0