CVE-2026-124011
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 12, 2026
Vendor
unknown
Description
XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.