CVE-2026-124005
CRITICAL
INFO
Priority: 0.05
BB Relevance:
79/100
Published: 2026-11-12
Modified: 2026-11-13
First seen: 2026-11-12
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
AT:
Present
VC:
High
VI:
High
VA:
High
Description
XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it's end of service date in March 2026.
Weakness Classification (1)
Affected Software (5)
References & Advisories (4)
vendor-advisory
third-party-advisory
technical-description
exploit
patch
product