CVE-2026-124012

Name of the Vulnerable Software and Affected Versions XWEB EVO versions 5.6.2 through 5.8.8

Description The Administrator web account is configured to use password mode daily password without a stored password. This occurs because the authenticate() function in lualib users.lua synthesizes the Administrator configuration without validating any stored secret. An attacker who can derive the MAC-based daily password can authenticate as an Administrator to obtain a full administrative session on the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.