XWEB EVO · CVE-2026-124012 · Other
NO FIX YET · SEE WHAT TO DO
XWEB EVO 5.6.2 to 5.8.8 lets anyone who can compute the MAC-based daily password log in as Administrator. The product is end of service, so no patch is coming; Copeland tells owners to take units off the Internet and move to XWEB PRO. Separately, CERT-FR reports compromised XWEB and Danfoss refrigeration controllers since October, but no source ties them to this CVE.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Copeland/Dixell XWEB EVO supervisors, firmware 5.6.2 to 5.8.8 (per VulnCheck), typically refrigeration and cold-chain monitoring in shops and cold storage. The Administrator login accepts a daily password derived from the device MAC address, so anyone who can reach the web login and works out the scheme gets full admin. Copeland's bulletin describes support issuing a temporary password from the date and MAC, which matches the mechanism. Units reachable only through a VPN or local network are much lower risk.
Not affected if admin-interface-restricted, unaffected-version, version-outside-5.6.2-5.8.8, vpn-only-access
Who cares copeland, dixell, end-of-service, refrigeration, self-hosted, web-admin, xweb-evo
5.6.2 through 5.8.8 is the range VulnCheck listss public IP: the XWEB login page must not appear (Copelands own test)XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
v1.16.1 current) and keep every unit off the public InternetThis page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.