CVE-2026-124006

Name of the Vulnerable Software and Affected Versions XWEB EVO versions prior to 5.8.9

Description The software contains a predictable credential generation issue that allows attackers to derive the Linux root password. This is achieved by computing a fixed prefix combined with a daily password value. For versions prior to 5.7.0, the root credential was identical across all units. From version 5.7.0 onwards, the credential remains derivable from the MAC-based daily password, enabling unauthorized root access to the underlying operating system.

Recommendations Update XWEB EVO to a version newer than 5.8.8.