CVE-2026-124004

Name of the Vulnerable Software and Affected Versions XWEB EVO versions prior to 5.6.2

Description The software contains a hardcoded backdoor password that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. By using the hardcoded credential xwebevonewgeneration in a single request, an attacker can obtain a complete admin session and full control over the application. Additionally, the system is susceptible to a pre-authentication root Remote Code Execution (RCE), which allows an attacker to execute arbitrary code with root privileges on the server.

Recommendations Update XWEB EVO to version 5.6.2 or later. Remove the device from the Wide Area Network (WAN) immediately to prevent remote access.