What is the fix for CVE-2026-124006?

No fix: Copeland says XWEB EVO is end of service and gets no further security patches. Migrate to XWEB PRO (v1.16.1 current) and take EVO units off the internet.

Post Share

CRITICAL9.2CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

XWEB EVO · CVE-2026-124006 · Infrastructure

XWEB EVO: predictable root password lets attackers derive root access

Q: Who is not affected by CVE-2026-124006?

Not affected if: newer-firmware-unknown, not-internet-exposed, xweb-pro.

NO FIX YET · SEE WHAT TO DO

XWEB EVO firmware up to 5.8.8 derives its Linux root password from a fixed prefix and a daily value tied to the MAC address, so anyone can compute it and get root. Copeland has ended support for EVO and will not ship a fix.

first public Nov 12, 2026 · 2 sources

Check it with your coding agent

It reads this page and tells you if your code or app is affected.

Claude CodeCodexCursorAdd to your agent

01 · Who is affected

XWEB EVO supervisors (refrigeration/HVAC monitoring controllers) running firmware 5.8.8 or earlier. The root password is computed from a fixed prefix and a daily value; before 5.7.0 it was identical on all units, from 5.7.0 it derives from the MAC address. The CVSS vector is network-reachable with no privileges, so units exposed to the internet are most at risk; units only on an isolated local network can lower the risk. XWEB PRO is not listed for this CVE.

XWEB EVO<= 5.8.8

Not affected if newer-firmware-unknown, not-internet-exposed, xweb-pro

Who cares embedded, end-of-life, linux, refrigeration, xweb-evo

02 · How to check

Find the firmware version in the XWEB EVO admin interface; any version up to and including 5.8.8 is covered by the CVE. No fixed EVO release exists.
Check internet exposure: from a connection off the site network (phone with Wi-Fi off), browse to the site's public IP; the XWEB login page must not appear. Also look for port forwards or DMZ rules to the unit.
The login page shows the MAC address (press CTRL+ALT); that and the date are the inputs to the daily password, both easy to learn.
Also check if you run XWEB PRO on outdated software: Copeland's bulletin covers PRO too, but this CVE lists only EVO.

03 · The fix

✓ Verified Nov 12

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 12, 2026

How it unfolded

2 events · Nov 12, 2026 → Nov 12, 2026

Nov 12, 202620:40 UTCNVD CVE-2026-124006
Nov 12, 202620:42 UTCInfraStack Analyst Vulncheck advisory + Copeland 3 Nov 2026 bulletin: EVO end of service, no patch; mitigation is removing from internet, VPN, VLAN, migrate to PRO. Bulletin does not name this CVE or versions; only fix=none verified. CERT-FR reports compromises of exposed units, cause not stated; exploited flag left false.moreless

What the sources say, verbatim

522 characters

XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026.

Sources and references

NVD: CVE-2026-124006Nov 12, 2026
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com
Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026)Fix · dxl.com.pl
France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

InfraStack checks it against your stack and answers on your report, with the evidence and the fix.

Run the check

Get the next XWEB EVO threat the day it hits your stack.

Start free

Post Share

CRITICAL9.2CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

XWEB EVO · CVE-2026-124006 · Infrastructure

XWEB EVO: predictable root password lets attackers derive root access

NO FIX YET · SEE WHAT TO DO

first public Nov 12, 2026 · 2 sources

Check it with your coding agent

It reads this page and tells you if your code or app is affected.

Claude CodeCodexCursorAdd to your agent

01 · Who is affected

XWEB EVO<= 5.8.8

Not affected if newer-firmware-unknown, not-internet-exposed, xweb-pro

Who cares embedded, end-of-life, linux, refrigeration, xweb-evo

02 · How to check

Find the firmware version in the XWEB EVO admin interface; any version up to and including 5.8.8 is covered by the CVE. No fixed EVO release exists.
Check internet exposure: from a connection off the site network (phone with Wi-Fi off), browse to the site's public IP; the XWEB login page must not appear. Also look for port forwards or DMZ rules to the unit.
The login page shows the MAC address (press CTRL+ALT); that and the date are the inputs to the daily password, both easy to learn.
Also check if you run XWEB PRO on outdated software: Copeland's bulletin covers PRO too, but this CVE lists only EVO.

03 · The fix

✓ Verified Nov 12

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 12, 2026

How it unfolded

2 events · Nov 12, 2026 → Nov 12, 2026

Nov 12, 202620:40 UTCNVD CVE-2026-124006
Nov 12, 202620:42 UTCInfraStack Analyst Vulncheck advisory + Copeland 3 Nov 2026 bulletin: EVO end of service, no patch; mitigation is removing from internet, VPN, VLAN, migrate to PRO. Bulletin does not name this CVE or versions; only fix=none verified. CERT-FR reports compromises of exposed units, cause not stated; exploited flag left false.moreless

What the sources say, verbatim

522 characters

Sources and references

NVD: CVE-2026-124006Nov 12, 2026
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com
Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026)Fix · dxl.com.pl
France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

InfraStack checks it against your stack and answers on your report, with the evidence and the fix.

Run the check

Get the next XWEB EVO threat the day it hits your stack.

Start free

XWEB EVO: predictable root password lets attackers derive root access

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next XWEB EVO threat the day it hits your stack.

XWEB EVO: predictable root password lets attackers derive root access

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next XWEB EVO threat the day it hits your stack.