Hardcoded Credential Vulnerability in Dixell Copeland XWEB EVO
CVE-2026-124012

9.2CRITICAL

Key Information:

Vendor

Copeland

Status
Xweb Evo
Vendor
CVE Published:
12 November 2026

What is CVE-2026-124012?

Dixell Copeland's XWEB EVO versions 5.6.2 through 5.8.8 possess a vulnerability allowing unauthorized administrator access due to hardcoded credentials. The 'Users.authenticate' function in 'lualib_users.lua' facilitates an insecure configuration where the administrator web account defaults to using a daily password without proper validation of a stored credential. This vulnerability can be exploited by attackers who can derive the MAC-based daily password, consequently gaining full access to the device as the Administrator. It is crucial to note that this product line has reached its end of service date as of March 2026.

Affected Version(s)

XWEB EVO 5.6.2 <= 5.8.8

References

https://webapps.copeland.com/Dixell/Pages/SystemSoftwareU...
patchproduct
https://webapps.copeland.com/dixell/Content/Pages/Adverti...
vendor-advisory
https://www.vulncheck.com/advisories/dixell-copeland-xweb...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
.