{"id":"CVE-2026-124006","kind":"vulnerability","aliases":["CVE-2026-124006"],"related":[],"title":"XWEB EVO: predictable root password lets attackers derive root access","description":"XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO firmware up to 5.8.8 derives its Linux root password from a fixed prefix and a daily value tied to the MAC address, so anyone can compute it and get root. Copeland has ended support for EVO and will not ship a fix.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"XWEB EVO","fixed":[],"affected":"<= 5.8.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["embedded","end-of-life","infrastructure","linux","refrigeration","xweb-evo"],"not_affected_if":["newer-firmware-unknown","not-internet-exposed","xweb-pro"],"how_to_check":"- Find the firmware version in the XWEB EVO admin interface; any version up to and including 5.8.8 is covered by the CVE. No fixed EVO release exists.\n- Check internet exposure: from a connection off the site network (phone with Wi-Fi off), browse to the site's public IP; the XWEB login page must not appear. Also look for port forwards or DMZ rules to the unit.\n- The login page shows the MAC address (press CTRL+ALT); that and the date are the inputs to the daily password, both easy to learn.\n- Also check if you run XWEB PRO on outdated software: Copeland's bulletin covers PRO too, but this CVE lists only EVO.","fix":"No fix: Copeland says XWEB EVO is end of service and gets no further security patches. Migrate to XWEB PRO (v1.16.1 current) and take EVO units off the internet.","status":"open","published_at":"2026-11-12T20:18:23+00:00","first_seen_at":"2026-11-12T20:40:23+00:00","triaged_at":"2026-11-12T20:41:52+00:00","updated_at":"2026-11-12T20:42:43+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-12T20:41:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"XWEB EVO: predictable root password lets attackers derive root access","impact":"high","summary":"XWEB EVO through version 5.8.8 generates its Linux root password from a fixed prefix and a daily value tied to the device MAC address, so the password can be computed. An attacker who computes it gets root access to the underlying operating system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["xweb-evo","embedded","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gets root access to the device's underlying Linux operating system","analyst_note":"Confirm whether a fixed firmware exists past 5.8.8 given end of service in March 2026, and whether the flaw is reachable from the network; check the vulncheck advisory.","how_to_check":"- Check the XWEB EVO firmware version on the device or its admin interface against `5.8.8`\n- Note the product line reached end of service in March 2026, so confirm whether a supported fixed release exists for your unit","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["newer-firmware-unknown"],"who_is_affected":"Organizations running XWEB EVO devices at or below version 5.8.8, with the root password derivable from the device MAC address. Units before 5.7.0 share one root password across all units. The sources do not say whether network reachability or other configuration changes the exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000736,"input_tokens":4636,"output_tokens":545,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether a fixed firmware exists past 5.8.8 given end of service in March 2026, and whether the flaw is reachable from the network; check the vulncheck advisory.","search":"'-124006':13A,16A '-2026':12A,15A '2026':154C '5.7.0':113C,121C '5.8.8':35B,77C 'access':10A,136C 'across':116C 'address':53B 'allow':85C 'anyon':55B 'attack':7A,86C,104C 'base':129C 'calcul':106C 'combin':98C 'comput':57B,94C 'contain':78C 'copeland':62B 'credenti':81C,110C 'cve':11A,14A 'daili':47B,101C,130C 'date':151C 'deriv':8A,36B,88C,124C 'determinist':108C 'embed':19B 'end':21B,64B,148C 'end-of-lif':20B 'evo':2A,18A,29B,31B,67B,75C 'firmwar':32B 'fix':43B,73B,96C 'gain':133C 'generat':82C 'get':60B 'ident':115C 'infrastructur':24B 'let':6A 'life':23B 'line':144C 'linux':25B,38B,90C 'mac':52B,128C 'mac-bas':127C 'march':153C 'onward':122C 'oper':140C 'password':5A,40B,92C,102C,131C 'predict':3A,80C 'prefix':44B,97C 'product':143C 'reach':145C 'refriger':26B 'remain':123C 'root':4A,9A,39B,61B,91C,109C,135C 'servic':150C 'ship':71B 'support':65B 'system':141C 'tie':49B 'unauthor':134C 'under':139C 'unit':118C 'valu':48B,103C 'vulner':83C 'xweb':1A,17A,28B,30B,74C 'xweb-evo':27B","nicknames":[],"mitigations":[],"who_affected":"XWEB EVO supervisors (refrigeration/HVAC monitoring controllers) running firmware 5.8.8 or earlier. The root password is computed from a fixed prefix and a daily value; before 5.7.0 it was identical on all units, from 5.7.0 it derives from the MAC address. The CVSS vector is network-reachable with no privileges, so units exposed to the internet are most at risk; units only on an isolated local network can lower the risk. XWEB PRO is not listed for this CVE.","tier":"B","verified":{"fix":{"at":"2026-11-12T20:42:43Z","by":"analyst","doc":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-root-password-generation","run_id":3773}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["evo","xwebevo"],"ptokens":["evo","xweb"],"labels":["critical","embedded","endoflife","infrastructure","linux","refrigeration","xwebevo"],"campaign_type":null,"search_a":"'-124006':13A,16A '-2026':12A,15A 'access':10A 'attack':7A 'cve':11A,14A 'deriv':8A 'evo':2A,18A 'let':6A 'password':5A 'predict':3A 'root':4A,9A 'xweb':1A,17A","search_b":"'5.8.8':35B 'address':53B 'anyon':55B 'comput':57B 'copeland':62B 'daili':47B 'deriv':36B 'embed':19B 'end':21B,64B 'end-of-lif':20B 'evo':29B,31B,67B 'firmwar':32B 'fix':43B,73B 'get':60B 'infrastructur':24B 'life':23B 'linux':25B,38B 'mac':52B 'password':40B 'prefix':44B 'refriger':26B 'root':39B,61B 'ship':71B 'support':65B 'tie':49B 'valu':48B 'xweb':28B,30B 'xweb-evo':27B","search_c":"'2026':154C '5.7.0':113C,121C '5.8.8':77C 'access':136C 'across':116C 'allow':85C 'attack':86C,104C 'base':129C 'calcul':106C 'combin':98C 'comput':94C 'contain':78C 'credenti':81C,110C 'daili':101C,130C 'date':151C 'deriv':88C,124C 'determinist':108C 'end':148C 'evo':75C 'fix':96C 'gain':133C 'generat':82C 'ident':115C 'line':144C 'linux':90C 'mac':128C 'mac-bas':127C 'march':153C 'onward':122C 'oper':140C 'password':92C,102C,131C 'predict':80C 'prefix':97C 'product':143C 'reach':145C 'remain':123C 'root':91C,109C,135C 'servic':150C 'system':141C 'unauthor':134C 'under':139C 'unit':118C 'valu':103C 'vulner':83C 'xweb':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124006","severity":null,"published_at":"2026-11-12T20:18:23+00:00","modified_at":"2026-11-12T20:18:23+00:00","first_seen_at":"2026-11-12T20:40:23+00:00","fetched_at":"2026-11-12T20:40:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124006:3773","url":"https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","severity":null,"published_at":"2026-11-12T20:42:43+00:00","modified_at":"2026-11-12T20:42:43+00:00","first_seen_at":"2026-11-12T20:42:43+00:00","fetched_at":"2026-11-12T20:42:43+00:00","note":"Vulncheck advisory + Copeland 3 Nov 2026 bulletin: EVO end of service, no patch; mitigation is removing from internet, VPN, VLAN, migrate to PRO. Bulletin does not name this CVE or versions; only fix=none verified. CERT-FR reports compromises of exposed units, cause not stated; exploited flag left false.","cites":["https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/"]}],"documents":[{"id":138263,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-root-password-generation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":138422,"url":"https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","title":"Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":138423,"url":"https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/","title":"France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}