---
id: "CVE-2026-124005"
page: "https://infrastack.ai/live/CVE-2026-124005"
kind: "vulnerability"
aliases: ["CVE-2026-124005"]
title: "XWEB EVO: predictable admin password lets attackers log in remotely"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "XWEB EVO", "fixed": [], "affected": ">= 4.3.0, <= 5.8.8", "ecosystem": "vendor"}]
ecosystems: []
tags: ["copeland", "dixell", "end-of-life", "ics", "infrastructure", "refrigeration", "xweb-evo"]
not_affected_if: ["not-internet-exposed", "unknown", "xweb-pro"]
published_at: "2026-11-12T20:18:22+00:00"
first_seen_at: "2026-11-12T20:40:23+00:00"
updated_at: "2026-11-12T20:42:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124005", "first_seen_at": "2026-11-12T20:40:23+00:00"}, {"source": "analyst", "url": "https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf", "first_seen_at": "2026-11-12T20:42:58+00:00", "cites": ["https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf", "https://strfrigro.blob.core.windows.net/ct-fileswebshop/nieuwtjes/Copeland-Xweb_Cyber-Incident_France_ENG.pdf"]}]
exploit_sources: []
---

# XWEB EVO: predictable admin password lets attackers log in remotely

Link for people: https://infrastack.ai/live/CVE-2026-124005 (this .md is for agents)

XWEB EVO (Copeland/Dixell refrigeration supervisors) 4.3.0 through 5.8.8 derive the Administrator code-of-the-day password from only the device MAC address and the date, with no server secret. Anyone who analyses the firmware's xwpasswd binary can compute valid credentials offline and log in as Administrator. Copeland ended software support for XWEB EVO on 16 March 2026 and says no security patches will be released.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:XWEB EVO affected >= 4.3.0, <= 5.8.8 fixed no fixed version listed

## How to check

Find every XWEB EVO unit and read its firmware version (SYSTEM > Update); 4.3.0 to 5.8.8 is affected. Then check reachability: from a connection off the site network (for example a phone with Wi-Fi off), open the site's public IP in a browser. If the XWEB login page appears, the unit is exposed. Also look for port forwards or a DMZ rule pointing at the XWEB.

## Fix

No fixed version: Copeland says XWEB EVO reached end of service and gets no security patches. Remove the unit from the public internet (no port forwarding, DMZ or public IP), reach it only through a VPN, segment it on its own VLAN, restrict outbound traffic, and migrate to XWEB PRO. Copeland says to review a possibly compromised unit from the local network, restore a clean backup, and change all user passwords.

## Timeline

- 2026-11-12T20:40:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124005
- 2026-11-12T20:42:58+00:00 analyst https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf — VulnCheck advisory (CVSS v4 9.2, AV:N) plus Copeland 14 Oct 2026 bulletin and Mar 2026 EoS bulletin read. Copeland: no patch, remove from internet, VPN, migrate to XWEB PRO. Copeland's bulletin acknowledges an XWEB EVO vulnerability but does not name this CVE; no public PoC or exploitation tied to this CVE found. Siblings CVE-2026-124006/124012/124014 same product.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-administrator-password-generation
- [fix] Copeland bulletin: end of software support for XWEB EVO (16 Mar 2026) https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf
- [mitigation] Copeland product bulletin 14 Oct 2026: security advisory for XWEB monitoring systems https://strfrigro.blob.core.windows.net/ct-fileswebshop/nieuwtjes/Copeland-Xweb_Cyber-Incident_France_ENG.pdf

## From the sources

XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it's end of service date in March 2026.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_