---
id: "CVE-2026-124011"
page: "https://infrastack.ai/live/CVE-2026-124011"
kind: "vulnerability"
aliases: ["CVE-2026-124011"]
title: "XWEB EVO: unauthenticated sysinfo.lua leaks MAC and clock, enabling password derivation"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "infrastructure", "network-devices", "xweb-evo"]
not_affected_if: ["firmware-outside-5.6.2-to-5.8.8"]
published_at: "2026-11-12T20:18:24+00:00"
first_seen_at: "2026-11-12T20:40:25+00:00"
updated_at: "2026-11-12T20:42:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124011", "first_seen_at": "2026-11-12T20:40:25+00:00"}]
exploit_sources: []
---

# XWEB EVO: unauthenticated sysinfo.lua leaks MAC and clock, enabling password derivation

Link for people: https://infrastack.ai/live/CVE-2026-124011 (this .md is for agents)

XWEB EVO devices from 5.6.2 through 5.8.8 expose their eth0 MAC address and system clock through sysinfo.lua without logging in. An attacker can use those values to derive the device's MAC-based daily password offline and log in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the firmware version is in the range 5.6.2 through 5.8.8 on the XWEB EVO device's admin or system information page
- Check whether sysinfo.lua answers without a login from the network

## Timeline

- 2026-11-12T20:40:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124011

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-information-disclosure-via-sysinfo-lua

## From the sources

XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_