{"id":"CVE-2026-124004","kind":"vulnerability","aliases":["CVE-2026-124004"],"related":[],"title":"XWEB EVO: hardcoded backdoor password grants unauthenticated full administrator access","description":"XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO versions before 5.6.2 ship a built-in Administrator account with a hardcoded password. An unauthenticated remote attacker can log in with that credential and get a full admin session over the application.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","xweb-evo"],"not_affected_if":["not-exposed-to-network","xweb-evo-5.6.2-or-later"],"how_to_check":"- Look for the XWEB EVO application and note its version; the sources state it is affected before `5.6.2`.\n- Check whether the Administrator account still accepts the default credential, if your vendor documents it.","fix":"- XWEB EVO: move to `5.6.2` or later, per the sources. The product line has reached end of service in March 2026, so a fixed release may not be available for every installation.","status":"open","published_at":"2026-11-12T20:18:22+00:00","first_seen_at":"2026-11-12T20:40:23+00:00","triaged_at":"2026-11-12T20:41:48+00:00","updated_at":"2026-11-12T20:41:48+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-12T20:41:48Z","model":"claude-haiku-5-5","output":{"fix":"- XWEB EVO: move to `5.6.2` or later, per the sources. The product line has reached end of service in March 2026, so a fixed release may not be available for every installation.","reach":"internet","title":"XWEB EVO: hardcoded backdoor password grants unauthenticated full administrator access","impact":"high","summary":"XWEB EVO versions before 5.6.2 ship a built-in Administrator account with a hardcoded password. An unauthenticated remote attacker can log in with that credential and get a full admin session over the application.","audience":"businesses","category":"other","nicknames":[],"who_cares":["xweb-evo","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gains full administrator control of the application in one request","analyst_note":"Confirm the fixed version and whether a patch exists for end-of-service installs; check the NVD and vendor pages for the fix status.","how_to_check":"- Look for the XWEB EVO application and note its version; the sources state it is affected before `5.6.2`.\n- Check whether the Administrator account still accepts the default credential, if your vendor documents it.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["xweb-evo-5.6.2-or-later","not-exposed-to-network"],"who_is_affected":"Organisations running XWEB EVO before 5.6.2 that expose its web interface to a network. The sources state the product line reached end of service in March 2026, so there may be no maintained patch to move to. Teams not running XWEB EVO can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000752,"input_tokens":4614,"output_tokens":582,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124004':13A,16A '-2026':12A,15A '2026':122C '5.6.2':28B,62C 'access':10A,78C 'account':35B,85C 'admin':54B,102C 'administr':9A,34B,77C,84C 'allow':70C 'applic':58B,109C 'attack':43B,73C,86C 'authent':88C 'backdoor':4A,66C 'built':32B,82C 'built-in':31B,81C 'complet':101C 'contain':63C 'control':106C 'credenti':49B,92C 'cve':11A,14A 'date':119C 'end':116C 'evo':2A,23B,25B,60C 'full':8A,53B,76C,105C 'gain':75C 'get':51B 'grant':6A 'hardcod':3A,38B,65C,91C 'host':20B 'line':112C 'log':45B 'march':121C 'obtain':99C 'password':5A,39B,67C 'product':111C 'reach':113C 'remot':42B,72C 'request':97C 'self':19B 'self-host':18B 'servic':118C 'session':55B,103C 'ship':29B 'singl':96C 'unauthent':7A,41B,71C 'use':89C 'version':26B 'vulner':68C 'xweb':1A,22B,24B,59C 'xweb-evo':21B 'xwebevonewgener':93C","nicknames":[],"mitigations":[],"who_affected":"Organisations running XWEB EVO before 5.6.2 that expose its web interface to a network. The sources state the product line reached end of service in March 2026, so there may be no maintained patch to move to. Teams not running XWEB EVO can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","other","selfhosted","xwebevo"],"campaign_type":null,"search_a":"'-124004':13A,16A '-2026':12A,15A 'access':10A 'administr':9A 'backdoor':4A 'cve':11A,14A 'evo':2A 'full':8A 'grant':6A 'hardcod':3A 'password':5A 'unauthent':7A 'xweb':1A","search_b":"'5.6.2':28B 'account':35B 'admin':54B 'administr':34B 'applic':58B 'attack':43B 'built':32B 'built-in':31B 'credenti':49B 'evo':23B,25B 'full':53B 'get':51B 'hardcod':38B 'host':20B 'log':45B 'password':39B 'remot':42B 'self':19B 'self-host':18B 'session':55B 'ship':29B 'unauthent':41B 'version':26B 'xweb':22B,24B 'xweb-evo':21B","search_c":"'2026':122C '5.6.2':62C 'access':78C 'account':85C 'admin':102C 'administr':77C,84C 'allow':70C 'applic':109C 'attack':73C,86C 'authent':88C 'backdoor':66C 'built':82C 'built-in':81C 'complet':101C 'contain':63C 'control':106C 'credenti':92C 'date':119C 'end':116C 'evo':60C 'full':76C,105C 'gain':75C 'hardcod':65C,91C 'line':112C 'march':121C 'obtain':99C 'password':67C 'product':111C 'reach':113C 'remot':72C 'request':97C 'servic':118C 'session':103C 'singl':96C 'unauthent':71C 'use':89C 'vulner':68C 'xweb':59C 'xwebevonewgener':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124004","severity":null,"published_at":"2026-11-12T20:18:22+00:00","modified_at":"2026-11-12T20:18:22+00:00","first_seen_at":"2026-11-12T20:40:23+00:00","fetched_at":"2026-11-12T20:40:23+00:00","note":null}],"documents":[{"id":138260,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-hardcoded-administrator-backdoor-password","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}