XWEB EVO: Hardcoded administrative backdoor
XWEB EVO before 5.6.2 contains a hardcoded backdoor password that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account.
CVE search metadata
CVE search record: CVE-2026-124004. Severity: critical. CVSS: 9.8. KEV: no. Product: XWEB EVO (< 5.6.2). Brief: XWEB EVO: Hardcoded administrative backdoor. Brief link: https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-backdoor-cve-2026-124004/
Triage facts
Revision 1- Applicability
- XWEB EVO (< 5.6.2)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 20:47 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete administrative session and full control over the application. This product line reached its end of service date in March 2026.
Impact
Successful exploitation allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account and full control over the application.
Recommendation
As the product has reached its end of service, users should be aware that the vulnerability persists.