{"id":"CVE-2026-124011","kind":"vulnerability","aliases":["CVE-2026-124011"],"related":[],"title":"XWEB EVO: unauthenticated sysinfo.lua leaks MAC and clock, enabling password derivation","description":"XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO devices from 5.6.2 through 5.8.8 expose their eth0 MAC address and system clock through sysinfo.lua without logging in. An attacker can use those values to derive the device's MAC-based daily password offline and log in.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","network-devices","xweb-evo"],"not_affected_if":["firmware-outside-5.6.2-to-5.8.8"],"how_to_check":"- Confirm the firmware version is in the range 5.6.2 through 5.8.8 on the XWEB EVO device's admin or system information page\n- Check whether sysinfo.lua answers without a login from the network","fix":null,"status":"open","published_at":"2026-11-12T20:18:24+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","triaged_at":"2026-11-12T20:42:18+00:00","updated_at":"2026-11-12T20:42:18+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T20:42:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"XWEB EVO: unauthenticated sysinfo.lua leaks MAC and clock, enabling password derivation","impact":"high","summary":"XWEB EVO devices from 5.6.2 through 5.8.8 expose their eth0 MAC address and system clock through sysinfo.lua without logging in. An attacker can use those values to derive the device's MAC-based daily password offline and log in.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["xweb-evo","embedded","network-devices"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker derives daily password and logs into the device","analyst_note":"Confirm the fixed version or mitigation for XWEB EVO 5.6.2-5.8.8 and the reach of sysinfo.lua; check the vulncheck advisory.","how_to_check":"- Confirm the firmware version is in the range 5.6.2 through 5.8.8 on the XWEB EVO device's admin or system information page\n- Check whether sysinfo.lua answers without a login from the network","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["firmware-outside-5.6.2-to-5.8.8"],"who_is_affected":"XWEB EVO devices running firmware 5.6.2 through 5.8.8 are exposed, because the pre-login page calls sysinfo.lua which discloses the MAC and clock. The product line has reached end of service as of March 2026, so no vendor fix is stated in the sources. Teams that run these devices should check their firmware version and restrict access to the management interface.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000769,"input_tokens":4643,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124011':14A,17A '-2026':13A,16A '2026':139C '5.6.2':30B,67C '5.8.8':32B,69C 'access':91C 'address':37B,86C,107C 'allow':76C 'also':94C 'attack':47B,78C,101C 'authent':123C 'base':59B,118C 'clock':8A,40B,89C,110C 'contain':70C 'cve':12A,15A 'daili':60B,119C 'date':136C 'deriv':11A,53B,114C 'devic':22B,28B,55B,82C,126C 'disclos':105C 'disclosur':73C 'embed':18B 'enabl':9A,121C 'end':133C 'eth0':35B,84C 'evo':2A,25B,27B,66C 'expos':33B 'feed':95C 'inform':72C 'infrastructur':19B 'leak':5A 'line':129C 'log':44B,64B 'login':99C 'mac':6A,36B,58B,85C,106C,117C 'mac-bas':57B,116C 'march':138C 'network':21B 'network-devic':20B 'obtain':80C 'offlin':62B,113C 'page':100C 'password':10A,61B,120C 'pre':98C 'pre-login':97C 'product':128C 'reach':130C 'servic':135C 'sysinfo.lua':4A,42B,92C 'system':39B,88C,109C 'unauthent':3A,77C 'unauthor':122C 'use':49B,103C 'valu':51B,111C 'vulner':74C 'without':43B 'xweb':1A,24B,26B,65C 'xweb-evo':23B","nicknames":[],"mitigations":[],"who_affected":"XWEB EVO devices running firmware 5.6.2 through 5.8.8 are exposed, because the pre-login page calls sysinfo.lua which discloses the MAC and clock. The product line has reached end of service as of March 2026, so no vendor fix is stated in the sources. Teams that run these devices should check their firmware version and restrict access to the management interface.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","infrastructure","medium","networkdevices","xwebevo"],"campaign_type":null,"search_a":"'-124011':14A,17A '-2026':13A,16A 'clock':8A 'cve':12A,15A 'deriv':11A 'enabl':9A 'evo':2A 'leak':5A 'mac':6A 'password':10A 'sysinfo.lua':4A 'unauthent':3A 'xweb':1A","search_b":"'5.6.2':30B '5.8.8':32B 'address':37B 'attack':47B 'base':59B 'clock':40B 'daili':60B 'deriv':53B 'devic':22B,28B,55B 'embed':18B 'eth0':35B 'evo':25B,27B 'expos':33B 'infrastructur':19B 'log':44B,64B 'mac':36B,58B 'mac-bas':57B 'network':21B 'network-devic':20B 'offlin':62B 'password':61B 'sysinfo.lua':42B 'system':39B 'use':49B 'valu':51B 'without':43B 'xweb':24B,26B 'xweb-evo':23B","search_c":"'2026':139C '5.6.2':67C '5.8.8':69C 'access':91C 'address':86C,107C 'allow':76C 'also':94C 'attack':78C,101C 'authent':123C 'base':118C 'clock':89C,110C 'contain':70C 'daili':119C 'date':136C 'deriv':114C 'devic':82C,126C 'disclos':105C 'disclosur':73C 'enabl':121C 'end':133C 'eth0':84C 'evo':66C 'feed':95C 'inform':72C 'line':129C 'login':99C 'mac':85C,106C,117C 'mac-bas':116C 'march':138C 'obtain':80C 'offlin':113C 'page':100C 'password':120C 'pre':98C 'pre-login':97C 'product':128C 'reach':130C 'servic':135C 'sysinfo.lua':92C 'system':88C,109C 'unauthent':77C 'unauthor':122C 'use':103C 'valu':111C 'vulner':74C 'xweb':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124011","severity":null,"published_at":"2026-11-12T20:18:24+00:00","modified_at":"2026-11-12T20:18:24+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","fetched_at":"2026-11-12T20:40:25+00:00","note":null}],"documents":[{"id":138269,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-information-disclosure-via-sysinfo-lua","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}