CVE-2026-124012 Dixell/Copeland XWEB EVO Hardcoded Administrator Daily Password Authentication Bypass
Attackers who derive the daily password can log in as Administrator to XWEB EVO controllers, which are end-of-service; operators should replace them.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- Yes
- Needs a specific call
- No
- Fix
- None listed
What is CVE-2026-124012?
CVE-2026-124012 is a critical hardcoded credentials vulnerability in Copeland XWEB EVO, published on 12 Nov 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026.
Weakness: CWE-798
Which versions are affected by CVE-2026-124012?
Having an affected version installed is enough. The problem is in what it ships or how it installs, so no code has to call it.
How do I fix CVE-2026-124012?
No fix has been published for CVE-2026-124012 yet. Limit exposure of the affected software until one is available.
Upgrade, then change or revoke the exposed credential wherever it is used. More about Hardcoded credentials.
Is CVE-2026-124012 being exploited?
There is no known exploitation of CVE-2026-124012 in the wild and no public exploit code.
Sources
Also known as GHSA-377h-qxrj-gfvj.