Hardcoded Backdoor Vulnerability in XWEB EVO by Dixell/Copeland

CVE-2026-124004

What is CVE-2026-124004?

XWEB EVO, prior to version 5.6.2, possesses a critical vulnerability that features a hardcoded backdoor password, allowing unauthorized remote attackers to execute administrative commands. By utilizing the hardcoded credential, attackers can gain privileged access to the built-in Administrator account with just a single request, enabling them to fully control the application without any form of authentication. This flaw poses a significant risk as it compromises the integrity and security of the system.

References