Weak Password Generation in Dixell Copeland's XWEB EVO

CVE-2026-124005

What is CVE-2026-124005?

Dixell Copeland's XWEB EVO versions 4.3.0 through 5.8.8 are vulnerable to a weak password generation flaw. This vulnerability enables remote attackers to derive the device's Administrator credentials using just the device's MAC address and the current date, without relying on any server secret. By analyzing the firmware binary responsible for password generation, attackers can compute valid Administrator passwords offline. This allows unauthorized individuals to access device functionalities that should be secured, posing a significant risk to system integrity and security.

References