{"id":"CVE-2026-124012","kind":"vulnerability","aliases":["CVE-2026-124012"],"related":[],"title":"XWEB EVO web admin login can be bypassed with a derivable daily password","description":"XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO 5.6.2 to 5.8.8 lets anyone who can compute the MAC-based daily password log in as Administrator. The product is end of service, so no patch is coming; Copeland tells owners to take units off the Internet and move to XWEB PRO. Separately, CERT-FR reports compromised XWEB and Danfoss refrigeration controllers since October, but no source ties them to this CVE.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"XWEB EVO","fixed":[],"affected":">= 5.6.2, <= 5.8.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["copeland","dixell","end-of-service","other","refrigeration","self-hosted","web-admin","xweb-evo"],"not_affected_if":["admin-interface-restricted","unaffected-version","version-outside-5.6.2-5.8.8","vpn-only-access"],"how_to_check":"Open the XWEB EVO web interface (or SYSTEM > Update) and read the firmware version; 5.6.2 through 5.8.8 is the range VulnCheck lists. Then, from a connection off the site network (phone with Wi-Fi off), browse to the site's public IP: the XWEB login page must not appear (Copeland's own test). Check the router for port forwards or DMZ pointing at the unit.","fix":"No fix: Copeland says XWEB EVO is end of service and gets no more security patches. Migrate to XWEB PRO (v1.16.1 current) and keep every unit off the public Internet.","status":"open","published_at":"2026-11-12T20:18:24+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","triaged_at":"2026-11-12T20:41:52+00:00","updated_at":"2026-11-12T20:42:52+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-12T20:41:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"XWEB EVO web admin login can be bypassed with a derivable daily password","impact":"high","summary":"XWEB EVO versions 5.6.2 through 5.8.8 generate the Administrator account's login password from a daily value tied to the device's MAC address, and the code never checks a stored secret. An attacker who can work out that daily password can log in as Administrator and get a full admin session on the device.","audience":"businesses","category":"other","nicknames":[],"who_cares":["xweb-evo","self-hosted","web-admin"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gets full Administrator session on the device.","analyst_note":"Confirm whether a fixed version or vendor advisory exists given end of service, and check the VulnCheck advisory for exploitation details and reach.","how_to_check":"- Check the XWEB EVO firmware version on the device admin interface; versions `5.6.2` through `5.8.8` are in the affected range.\n- Check whether the Administrator account uses the `daily_password` mode in `lualib_users.lua` or its configuration.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version","admin-interface-restricted"],"who_is_affected":"Organizations running XWEB EVO devices on versions 5.6.2 through 5.8.8, especially where the web admin interface is reachable from networks outside the device's management segment. The product line has reached end of service as of March 2026, so a vendor fix may not come; sources do not say whether one exists. Devices that are not on the affected versions or have the admin interface restricted can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00077,"input_tokens":4646,"output_tokens":610,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version or vendor advisory exists given end of service, and check the VulnCheck advisory for exploitation details and reach.","search":"'-124012':16A,19A '-2026':15A,18A '2026':182C '5.6.2':41B,107C '5.8.8':43B,109C 'account':119C 'admin':4A,35B,165C 'administr':58B,117C,140C,160C 'anyon':45B 'attack':147C 'authent':158C 'base':52B,154C 'bypass':8A 'cert':86B 'cert-fr':85B 'come':69B 'compromis':89B 'comput':48B 'configur':121C,141C 'contain':110C 'control':94B 'copeland':22B,70B 'credenti':113C 'cve':14A,17A,104B 'daili':12A,53B,126C,155C 'danfoss':92B 'date':179C 'deriv':11A,150C 'devic':169C 'dixel':23B 'end':25B,62B,176C 'end-of-servic':24B 'evo':2A,21A,38B,40B,106C 'fr':87B 'full':164C 'function':135C 'hardcod':112C 'host':32B 'internet':78B 'let':44B 'line':172C 'log':55B 'login':5A 'lualib_users.lua':137C 'mac':51B,153C 'mac-bas':50B,152C 'march':181C 'mode':125C 'move':80B 'obtain':162C 'octob':96B 'owner':72B 'password':13A,54B,124C,127C,131C,156C 'patch':67B 'pro':83B 'product':60B,171C 'reach':173C 'refriger':29B,93B 'report':88B 'secret':146C 'self':31B 'self-host':30B 'separ':84B 'servic':27B,64B,178C 'session':166C 'sinc':95B 'sourc':99B 'store':130C,145C 'synthes':138C 'take':74B 'tell':71B 'tie':100B 'unit':75B 'use':123C 'users.authenticate':134C 'valid':143C 'vulner':114C 'web':3A,34B,118C 'web-admin':33B 'without':142C 'xweb':1A,20A,37B,39B,82B,90B,105C 'xweb-evo':36B","nicknames":[],"mitigations":[],"who_affected":"Sites running Copeland/Dixell XWEB EVO supervisors, firmware 5.6.2 to 5.8.8 (per VulnCheck), typically refrigeration and cold-chain monitoring in shops and cold storage. The Administrator login accepts a daily password derived from the device MAC address, so anyone who can reach the web login and works out the scheme gets full admin. Copeland's bulletin describes support issuing a temporary password from the date and MAC, which matches the mechanism. Units reachable only through a VPN or local network are much lower risk.","tier":"B","verified":{"fix":{"at":"2026-11-12T20:42:52Z","by":"analyst","doc":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-hardcoded-administrator-daily-password-authentication-bypass","run_id":3772}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["evo","xwebevo"],"ptokens":["evo","xweb"],"labels":["copeland","critical","dixell","endofservice","other","refrigeration","selfhosted","webadmin","xwebevo"],"campaign_type":null,"search_a":"'-124012':16A,19A '-2026':15A,18A 'admin':4A 'bypass':8A 'cve':14A,17A 'daili':12A 'deriv':11A 'evo':2A,21A 'login':5A 'password':13A 'web':3A 'xweb':1A,20A","search_b":"'5.6.2':41B '5.8.8':43B 'admin':35B 'administr':58B 'anyon':45B 'base':52B 'cert':86B 'cert-fr':85B 'come':69B 'compromis':89B 'comput':48B 'control':94B 'copeland':22B,70B 'cve':104B 'daili':53B 'danfoss':92B 'dixel':23B 'end':25B,62B 'end-of-servic':24B 'evo':38B,40B 'fr':87B 'host':32B 'internet':78B 'let':44B 'log':55B 'mac':51B 'mac-bas':50B 'move':80B 'octob':96B 'owner':72B 'password':54B 'patch':67B 'pro':83B 'product':60B 'refriger':29B,93B 'report':88B 'self':31B 'self-host':30B 'separ':84B 'servic':27B,64B 'sinc':95B 'sourc':99B 'take':74B 'tell':71B 'tie':100B 'unit':75B 'web':34B 'web-admin':33B 'xweb':37B,39B,82B,90B 'xweb-evo':36B","search_c":"'2026':182C '5.6.2':107C '5.8.8':109C 'account':119C 'admin':165C 'administr':117C,140C,160C 'attack':147C 'authent':158C 'base':154C 'configur':121C,141C 'contain':110C 'credenti':113C 'daili':126C,155C 'date':179C 'deriv':150C 'devic':169C 'end':176C 'evo':106C 'full':164C 'function':135C 'hardcod':112C 'line':172C 'lualib_users.lua':137C 'mac':153C 'mac-bas':152C 'march':181C 'mode':125C 'obtain':162C 'password':124C,127C,131C,156C 'product':171C 'reach':173C 'secret':146C 'servic':178C 'session':166C 'store':130C,145C 'synthes':138C 'use':123C 'users.authenticate':134C 'valid':143C 'vulner':114C 'web':118C 'without':142C 'xweb':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124012","severity":null,"published_at":"2026-11-12T20:18:24+00:00","modified_at":"2026-11-12T20:18:24+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","fetched_at":"2026-11-12T20:40:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124012:3772","url":"https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","severity":null,"published_at":"2026-11-12T20:42:52+00:00","modified_at":"2026-11-12T20:42:52+00:00","first_seen_at":"2026-11-12T20:42:52+00:00","fetched_at":"2026-11-12T20:42:52+00:00","note":"VulnCheck advisory confirms range 5.6.2-5.8.8; Copeland 3 Nov bulletin says EVO is EoS with no patches, lists isolation/VPN steps. CERT-FR compromises (via CTOL) not attributed to this CVE, so exploited left false. No PoC found. Sibling CVE-2026-124002 (pre-auth cmd injection) same product. No check written: version lives on the device, not in a repo.","cites":["https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/"]}],"documents":[{"id":138270,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-hardcoded-administrator-daily-password-authentication-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":138422,"url":"https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","title":"Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":138423,"url":"https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/","title":"France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}