---
id: "CVE-2026-124006"
page: "https://infrastack.ai/live/CVE-2026-124006"
kind: "vulnerability"
aliases: ["CVE-2026-124006"]
title: "XWEB EVO: predictable root password lets attackers derive root access"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "XWEB EVO", "fixed": [], "affected": "<= 5.8.8", "ecosystem": "vendor"}]
ecosystems: []
tags: ["embedded", "end-of-life", "infrastructure", "linux", "refrigeration", "xweb-evo"]
not_affected_if: ["newer-firmware-unknown", "not-internet-exposed", "xweb-pro"]
published_at: "2026-11-12T20:18:23+00:00"
first_seen_at: "2026-11-12T20:40:23+00:00"
updated_at: "2026-11-12T20:42:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124006", "first_seen_at": "2026-11-12T20:40:23+00:00"}, {"source": "analyst", "url": "https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf", "first_seen_at": "2026-11-12T20:42:43+00:00", "cites": ["https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf", "https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/"]}]
exploit_sources: []
---

# XWEB EVO: predictable root password lets attackers derive root access

Link for people: https://infrastack.ai/live/CVE-2026-124006 (this .md is for agents)

XWEB EVO firmware up to 5.8.8 derives its Linux root password from a fixed prefix and a daily value tied to the MAC address, so anyone can compute it and get root. Copeland has ended support for EVO and will not ship a fix.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:XWEB EVO affected <= 5.8.8 fixed no fixed version listed

## How to check

- Find the firmware version in the XWEB EVO admin interface; any version up to and including 5.8.8 is covered by the CVE. No fixed EVO release exists.
- Check internet exposure: from a connection off the site network (phone with Wi-Fi off), browse to the site's public IP; the XWEB login page must not appear. Also look for port forwards or DMZ rules to the unit.
- The login page shows the MAC address (press CTRL+ALT); that and the date are the inputs to the daily password, both easy to learn.
- Also check if you run XWEB PRO on outdated software: Copeland's bulletin covers PRO too, but this CVE lists only EVO.

## Fix

No fix: Copeland says XWEB EVO is end of service and gets no further security patches. Migrate to XWEB PRO (v1.16.1 current) and take EVO units off the internet.

## Timeline

- 2026-11-12T20:40:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124006
- 2026-11-12T20:42:43+00:00 analyst https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf — Vulncheck advisory + Copeland 3 Nov 2026 bulletin: EVO end of service, no patch; mitigation is removing from internet, VPN, VLAN, migrate to PRO. Bulletin does not name this CVE or versions; only fix=none verified. CERT-FR reports compromises of exposed units, cause not stated; exploited flag left false.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-predictable-root-password-generation
- [fix] Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026) https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf
- [mentions] France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/

## From the sources

XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_