{"id":"CVE-2026-124005","kind":"vulnerability","aliases":["CVE-2026-124005"],"related":[],"title":"XWEB EVO: predictable admin password lets attackers log in remotely","description":"XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO (Copeland/Dixell refrigeration supervisors) 4.3.0 through 5.8.8 derive the Administrator code-of-the-day password from only the device MAC address and the date, with no server secret. Anyone who analyses the firmware's xwpasswd binary can compute valid credentials offline and log in as Administrator. Copeland ended software support for XWEB EVO on 16 March 2026 and says no security patches will be released.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"XWEB EVO","fixed":[],"affected":">= 4.3.0, <= 5.8.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["copeland","dixell","end-of-life","ics","infrastructure","refrigeration","xweb-evo"],"not_affected_if":["not-internet-exposed","unknown","xweb-pro"],"how_to_check":"Find every XWEB EVO unit and read its firmware version (SYSTEM > Update); 4.3.0 to 5.8.8 is affected. Then check reachability: from a connection off the site network (for example a phone with Wi-Fi off), open the site's public IP in a browser. If the XWEB login page appears, the unit is exposed. Also look for port forwards or a DMZ rule pointing at the XWEB.","fix":"No fixed version: Copeland says XWEB EVO reached end of service and gets no security patches. Remove the unit from the public internet (no port forwarding, DMZ or public IP), reach it only through a VPN, segment it on its own VLAN, restrict outbound traffic, and migrate to XWEB PRO. Copeland says to review a possibly compromised unit from the local network, restore a clean backup, and change all user passwords.","status":"open","published_at":"2026-11-12T20:18:22+00:00","first_seen_at":"2026-11-12T20:40:23+00:00","triaged_at":"2026-11-12T20:41:55+00:00","updated_at":"2026-11-12T20:42:58+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-12T20:41:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"XWEB EVO: predictable admin password lets attackers log in remotely","impact":"high","summary":"XWEB EVO devices from 4.3.0 through 5.8.8 generate their Administrator daily password from only the device MAC address and the date. An attacker who reverses the firmware's xwpasswd generator can compute that password offline and log in as Administrator without authorization.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["xweb-evo"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker logs in as Administrator on the device","analyst_note":"Confirm the vendor's position on a fix or replacement for XWEB EVO after end of service, and whether the management interface is reachable from the internet; see the VulnCheck advisory linked in the sources.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Any XWEB EVO device running a version from 4.3.0 through 5.8.8 is exposed, since the Administrator password is derivable from the MAC address and date. The sources do not say whether the flaw needs network access to the device's management interface, and they note the product line reached end of service in March 2026, so no vendor fix may come.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000715,"input_tokens":4636,"output_tokens":503,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the vendor's position on a fix or replacement for XWEB EVO after end of service, and whether the management interface is reachable from the internet; see the VulnCheck advisory linked in the sources.","search":"'-124005':13A,16A '-2026':12A,15A '16':87B '2026':89B,175C '4.3.0':36B,100C '5.8.8':38B,102C 'address':53B,128C 'admin':4A 'administr':41B,78B,116C,153C 'allow':110C 'analys':63B 'analyz':138C 'anyon':61B 'attack':7A,112C,136C 'authent':157C 'author':162C 'binari':68B,141C 'code':43B,118C 'code-of-the-day':42B,117C 'comput':70B,151C 'contain':103C 'copeland':19B,79B 'copeland/dixell':33B 'credenti':72B,154C 'cve':11A,14A 'date':56B,130C,172C 'day':46B,121C 'deriv':39B,114C 'devic':51B,126C,160C 'dixel':20B 'end':22B,80B,169C 'end-of-lif':21B 'evo':2A,18A,30B,32B,85B,99C 'firmwar':65B,140C 'function':145C 'generat':107C,149C 'ic':25B 'infrastructur':26B 'involv':135C 'let':6A 'life':24B 'line':165C 'log':8A,75B 'mac':52B,127C 'march':88B,174C 'offlin':73B,155C 'password':5A,47B,106C,122C,148C 'patch':94B 'predict':3A 'product':164C 'reach':166C 'refriger':27B,34B 'releas':97B 'remot':10A,111C 'say':91B 'secret':60B,134C 'secur':93B 'server':59B,133C 'servic':171C 'softwar':81B 'supervisor':35B 'support':82B 'use':123C 'valid':71B,152C 'vulner':108C 'weak':105C 'without':161C 'xweb':1A,17A,29B,31B,84B,98C 'xweb-evo':28B 'xwpasswd':67B,142C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Copeland/Dixell XWEB EVO supervisors (firmware 4.3.0 to 5.8.8), typically in supermarkets, cold storage and other refrigeration sites. Exposure depends on whether the web interface can be reached from the internet or an untrusted network; units only on an isolated local network are far less exposed. XWEB PRO is not listed in the advisory for this CVE.","tier":"B","verified":{"fix":{"at":"2026-11-12T20:42:58Z","by":"analyst","doc":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-administrator-password-generation","run_id":3774},"products":{"at":"2026-11-12T20:42:58Z","by":"analyst","doc":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-administrator-password-generation","run_id":3774},"mitigations":{"at":"2026-11-12T20:42:58Z","by":"analyst","doc":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-administrator-password-generation","run_id":3774}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["evo","xwebevo"],"ptokens":["evo","xweb"],"labels":["copeland","critical","dixell","endoflife","ics","infrastructure","refrigeration","xwebevo"],"campaign_type":null,"search_a":"'-124005':13A,16A '-2026':12A,15A 'admin':4A 'attack':7A 'cve':11A,14A 'evo':2A,18A 'let':6A 'log':8A 'password':5A 'predict':3A 'remot':10A 'xweb':1A,17A","search_b":"'16':87B '2026':89B '4.3.0':36B '5.8.8':38B 'address':53B 'administr':41B,78B 'analys':63B 'anyon':61B 'binari':68B 'code':43B 'code-of-the-day':42B 'comput':70B 'copeland':19B,79B 'copeland/dixell':33B 'credenti':72B 'date':56B 'day':46B 'deriv':39B 'devic':51B 'dixel':20B 'end':22B,80B 'end-of-lif':21B 'evo':30B,32B,85B 'firmwar':65B 'ic':25B 'infrastructur':26B 'life':24B 'log':75B 'mac':52B 'march':88B 'offlin':73B 'password':47B 'patch':94B 'refriger':27B,34B 'releas':97B 'say':91B 'secret':60B 'secur':93B 'server':59B 'softwar':81B 'supervisor':35B 'support':82B 'valid':71B 'xweb':29B,31B,84B 'xweb-evo':28B 'xwpasswd':67B","search_c":"'2026':175C '4.3.0':100C '5.8.8':102C 'address':128C 'administr':116C,153C 'allow':110C 'analyz':138C 'attack':112C,136C 'authent':157C 'author':162C 'binari':141C 'code':118C 'code-of-the-day':117C 'comput':151C 'contain':103C 'credenti':154C 'date':130C,172C 'day':121C 'deriv':114C 'devic':126C,160C 'end':169C 'evo':99C 'firmwar':140C 'function':145C 'generat':107C,149C 'involv':135C 'line':165C 'mac':127C 'march':174C 'offlin':155C 'password':106C,122C,148C 'product':164C 'reach':166C 'remot':111C 'secret':134C 'server':133C 'servic':171C 'use':123C 'valid':152C 'vulner':108C 'weak':105C 'without':161C 'xweb':98C 'xwpasswd':142C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124005","severity":null,"published_at":"2026-11-12T20:18:22+00:00","modified_at":"2026-11-12T20:18:22+00:00","first_seen_at":"2026-11-12T20:40:23+00:00","fetched_at":"2026-11-12T20:40:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124005:3774","url":"https://strfrigro.blob.core.windows.net/ct-fileswebshop/nieuwtjes/Copeland-Xweb_Cyber-Incident_France_ENG.pdf","severity":null,"published_at":"2026-11-12T20:42:58+00:00","modified_at":"2026-11-12T20:42:58+00:00","first_seen_at":"2026-11-12T20:42:58+00:00","fetched_at":"2026-11-12T20:42:58+00:00","note":"VulnCheck advisory (CVSS v4 9.2, AV:N) plus Copeland 14 Oct 2026 bulletin and Mar 2026 EoS bulletin read. Copeland: no patch, remove from internet, VPN, migrate to XWEB PRO. Copeland's bulletin acknowledges an XWEB EVO vulnerability but does not name this CVE; no public PoC or exploitation tied to this CVE found. Siblings CVE-2026-124006/124012/124014 same product.","cites":["https://strfrigro.blob.core.windows.net/ct-fileswebshop/nieuwtjes/Copeland-Xweb_Cyber-Incident_France_ENG.pdf","https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf"]}],"documents":[{"id":138261,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-administrator-password-generation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":138425,"url":"https://strfrigro.blob.core.windows.net/ct-fileswebshop/nieuwtjes/Copeland-Xweb_Cyber-Incident_France_ENG.pdf","title":"Copeland product bulletin 14 Oct 2026: security advisory for XWEB monitoring systems","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":138428,"url":"https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf","title":"Copeland bulletin: end of software support for XWEB EVO (16 Mar 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}