CVE-2026-124005

Name of the Vulnerable Software and Affected Versions XWEB EVO versions 4.3.0 through 5.8.8

Description A weak password generation mechanism allows remote attackers to derive the Administrator code-of-the-day password. This is possible by using only the device MAC address and the current date, as no server secret is involved in the process. Attackers can analyze the xwpasswd firmware binary, which serves as the password generator, to compute valid Administrator credentials offline and gain unauthorized access to the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.