CVE-2026-124004 Dixell/Copeland XWEB EVO Hardcoded Administrator Backdoor Password
Unauthenticated remote attackers can log in as full administrator using a hardcoded backdoor password on XWEB EVO controllers; operators of these end-of-service devices should care.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- Yes
- Needs a specific call
- No
- Fix
- None listed
What is CVE-2026-124004?
CVE-2026-124004 is a critical hardcoded credentials vulnerability in Copeland XWEB EVO, published on 12 Nov 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026.
Weakness: CWE-798
Which versions are affected by CVE-2026-124004?
Having an affected version installed is enough. The problem is in what it ships or how it installs, so no code has to call it.
How do I fix CVE-2026-124004?
No fix has been published for CVE-2026-124004 yet. Limit exposure of the affected software until one is available.
Upgrade, then change or revoke the exposed credential wherever it is used. More about Hardcoded credentials.
Is CVE-2026-124004 being exploited?
There is no known exploitation of CVE-2026-124004 in the wild and no public exploit code.
Sources
Also known as GHSA-9vpc-28gc-f73j.