CVE Watch12 de nov. de 2026

CVE-2026-124011

XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's e

CVSS

5.3

Média

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 12 de nov. de 2026 · Última mod.: 12 de nov. de 2026 · CWE-497

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-961375.5 MÉD

40.2%

——12Exposure of sensitive system information to an unauthorized control sphere in Windows Graphics Kernel allows an authorized attacker to disclose information locally.2d CVE-2026-960015.5 MÉD

45.5%

——14Exposure of sensitive system information to an unauthorized control sphere in Windows Bluetooth Service allows an authorized attacker to disclose information locally.2d CVE-2026-1199424.7 MÉD

32.1%

——10Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.2d CVE-2026-1198825.3 MÉD

57.7%

——17Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker to disclose information over a network.2d CVE-2026-1198565.5 MÉD

42.6%

——13Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally.2d CVE-2026-1198227.0 ALT

30.6%

——9Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.2d