CVE-2026-124011 · Infrastructure
NO FIX YET
XWEB EVO devices from 5.6.2 through 5.8.8 expose their eth0 MAC address and system clock through sysinfo.lua without logging in. An attacker can use those values to derive the device's MAC-based daily password offline and log in.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
XWEB EVO devices running firmware 5.6.2 through 5.8.8 are exposed, because the pre-login page calls sysinfo.lua which discloses the MAC and clock. The product line has reached end of service as of March 2026, so no vendor fix is stated in the sources. Teams that run these devices should check their firmware version and restrict access to the management interface.
Not affected if firmware-outside-5.6.2-to-5.8.8
Who cares embedded, network-devices, xweb-evo
No fix yet, per the sources.
XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.