https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-15T02:06:18.780260+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-124012 CVE-2026-124012 — Dixell/Copeland XWEB EVO Hardcoded Administrator Daily Password Authentication Bypass 2026-11-15T02:06:18.781527+00:00

Affected: Copeland XWEB EVO

XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026.