CVE-2026-124011
Dixell/Copeland XWEB EVO Information Disclosure via sysinfo.lua
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.
| CWE | CWE-497 |
| Vendor | copeland |
| Product | xweb evo |
| Published | Nov 12, 2026 |
| Last Updated | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for copeland xweb evo
Be the first to know when new medium vulnerabilities affecting copeland xweb evo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Copeland / XWEB EVO
5.6.2 ≤ 5.8.8
References
webapps.copeland.com: https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate webapps.copeland.com: https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf vulncheck.com: https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-information-disclosure-via-sysinfo-lua
Credits
Valentin Lobstein (Chocapikk)