{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acarelxweb_evo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:carel:xweb_evo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-124012"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["XWEB EVO (5.6.2-5.8.8)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Carel"],"content_html":"\u003cp\u003eCarel XWEB EVO versions 5.6.2 through 5.8.8 contain a hardcoded credential vulnerability where the Administrator web account is configured to use 'daily_password' mode. The vulnerability exists in the 'Users.authenticate' function within 'lualib_users.lua', which synthesizes the Administrator configuration without validating a stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached its end-of-service date in March 2026.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful authentication as Administrator provides a full administrative session on the device.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eThis product reached its end-of-service date in March 2026.\u003c/p\u003e\n","date_modified":"2026-11-12T20:49:29Z","date_published":"2026-11-12T20:49:29Z","id":"https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-hardcoded-credentials-cve-2026-124012/","summary":"Carel XWEB EVO versions 5.6.2 through 5.8.8 contain a hardcoded credential vulnerability in the Users.authenticate function allowing authentication as Administrator via a derived daily password.","title":"Carel XWEB EVO: Hardcoded credential vulnerability (CVE-2026-124012)","url":"https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-hardcoded-credentials-cve-2026-124012/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:carel:xweb_evo:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}