CVE-2026-124011
XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's e
CVSS
5.3
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 12 nov 2026 · Última mod.: 12 nov 2026 · CWE-497
Sin historial EPSS suficiente todavía.
XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.
- webapps.copeland.comhttps://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
- webapps.copeland.comhttps://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf
- www.vulncheck.comhttps://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-information-disclosure-via-sysinfo-lua
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-961375.5 MED40.2%
——12Exposure of sensitive system information to an unauthorized control sphere in Windows Graphics Kernel allows an authorized attacker to disclose information locally.2dCVE-2026-960015.5 MED45.5%
——14Exposure of sensitive system information to an unauthorized control sphere in Windows Bluetooth Service allows an authorized attacker to disclose information locally.2dCVE-2026-1199424.7 MED32.1%
——10Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.2dCVE-2026-1198825.3 MED57.7%
——17Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker to disclose information over a network.2dCVE-2026-1198565.5 MED42.6%
——13Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally.2dCVE-2026-1198227.0 ALT30.6%
——9Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.2d