---
id: "CVE-2026-124012"
page: "https://infrastack.ai/live/CVE-2026-124012"
kind: "vulnerability"
aliases: ["CVE-2026-124012"]
title: "XWEB EVO web admin login can be bypassed with a derivable daily password"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "XWEB EVO", "fixed": [], "affected": ">= 5.6.2, <= 5.8.8", "ecosystem": "vendor"}]
ecosystems: []
tags: ["copeland", "dixell", "end-of-service", "other", "refrigeration", "self-hosted", "web-admin", "xweb-evo"]
not_affected_if: ["admin-interface-restricted", "unaffected-version", "version-outside-5.6.2-5.8.8", "vpn-only-access"]
published_at: "2026-11-12T20:18:24+00:00"
first_seen_at: "2026-11-12T20:40:25+00:00"
updated_at: "2026-11-12T20:42:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124012", "first_seen_at": "2026-11-12T20:40:25+00:00"}, {"source": "analyst", "url": "https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/", "first_seen_at": "2026-11-12T20:42:52+00:00", "cites": ["https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/", "https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf"]}]
exploit_sources: []
---

# XWEB EVO web admin login can be bypassed with a derivable daily password

Link for people: https://infrastack.ai/live/CVE-2026-124012 (this .md is for agents)

XWEB EVO 5.6.2 to 5.8.8 lets anyone who can compute the MAC-based daily password log in as Administrator. The product is end of service, so no patch is coming; Copeland tells owners to take units off the Internet and move to XWEB PRO. Separately, CERT-FR reports compromised XWEB and Danfoss refrigeration controllers since October, but no source ties them to this CVE.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:XWEB EVO affected >= 5.6.2, <= 5.8.8 fixed no fixed version listed

## How to check

Open the XWEB EVO web interface (or SYSTEM > Update) and read the firmware version; 5.6.2 through 5.8.8 is the range VulnCheck lists. Then, from a connection off the site network (phone with Wi-Fi off), browse to the site's public IP: the XWEB login page must not appear (Copeland's own test). Check the router for port forwards or DMZ pointing at the unit.

## Fix

No fix: Copeland says XWEB EVO is end of service and gets no more security patches. Migrate to XWEB PRO (v1.16.1 current) and keep every unit off the public Internet.

## Timeline

- 2026-11-12T20:40:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124012
- 2026-11-12T20:42:52+00:00 analyst https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/ — VulnCheck advisory confirms range 5.6.2-5.8.8; Copeland 3 Nov bulletin says EVO is EoS with no patches, lists isolation/VPN steps. CERT-FR compromises (via CTOL) not attributed to this CVE, so exploited left false. No PoC found. Sibling CVE-2026-124002 (pre-auth cmd injection) same product. No check written: version lives on the device, not in a repo.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-hardcoded-administrator-daily-password-authentication-bypass
- [mentions] France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/
- [mitigation] Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026) https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf

## From the sources

XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_