{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aemersonxweb_evo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:emerson:xweb_evo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-124005"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["XWEB EVO (4.3.0-5.8.8)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Emerson"],"content_html":"\u003cp\u003eEmerson XWEB EVO versions 4.3.0 through 5.8.8 contain a weak password generation vulnerability (CVE-2026-124005). The firmware component 'xwpasswd' generates daily administrative passwords using only the device MAC address and the current date, without incorporating a unique server secret. This flaw allows an attacker to reverse-engineer the algorithm by analyzing the 'xwpasswd' binary and compute valid administrator credentials offline for any affected device. This product line reached end-of-service in March 2026 and will not receive security patches.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to derive Administrator credentials, granting them full unauthorized access to the device. The lack of a secret key means the generation process is fully deterministic if the MAC address and date are known.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSince the product has reached its end of service, prioritize network isolation for all affected XWEB EVO units. Restrict management interface access to trusted internal IP ranges or VPNs.\u003c/li\u003e\n\u003cli\u003eConduct an inventory of all XWEB EVO deployments and confirm firmware versions. Given the end-of-service status, migration to current, supported hardware is the primary mitigation strategy.\u003c/li\u003e\n\u003cli\u003eMonitor network logs for unusual, repeated administrative logins to industrial control interface ports that correlate with unauthorized remote sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T20:48:47Z","date_published":"2026-11-12T20:48:47Z","id":"https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-weak-password-cve-2026-124005/","summary":"The XWEB EVO product line (versions 4.3.0-5.8.8) is vulnerable to unauthorized remote access because its 'xwpasswd' firmware component derives Administrator passwords solely from the device MAC address and current date.","title":"Emerson XWEB EVO: Weak password generation vulnerability (CVE-2026-124005)","url":"https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-weak-password-cve-2026-124005/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:emerson:xweb_evo:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}