Carel XWEB EVO: Hardcoded credential vulnerability (CVE-2026-124012)
Carel XWEB EVO versions 5.6.2 through 5.8.8 contain a hardcoded credential vulnerability in the Users.authenticate function allowing authentication as Administrator via a derived daily password.
CVE search metadata
CVE search record: CVE-2026-124012. Severity: high. CVSS: 8.1. KEV: no. Product: XWEB EVO (5.6.2-5.8.8). Brief: Carel XWEB EVO: Hardcoded credential vulnerability (CVE-2026-124012). Brief link: https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-hardcoded-credentials-cve-2026-124012/
Triage facts
Revision 1- Applicability
- XWEB EVO (5.6.2-5.8.8)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 20:49 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Carel XWEB EVO versions 5.6.2 through 5.8.8 contain a hardcoded credential vulnerability where the Administrator web account is configured to use 'daily_password' mode. The vulnerability exists in the 'Users.authenticate' function within 'lualib_users.lua', which synthesizes the Administrator configuration without validating a stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached its end-of-service date in March 2026.
Impact
Successful authentication as Administrator provides a full administrative session on the device.
Recommendation
This product reached its end-of-service date in March 2026.