Cpe:2.3:a:emerson:xweb_evo:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aemersonxweb_evo/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 20:48:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEmerson XWEB EVO: Weak password generation vulnerability (CVE-2026-124005)https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-weak-password-cve-2026-124005/Thu, 12 Nov 2026 20:48:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-xweb-evo-weak-password-cve-2026-124005/The XWEB EVO product line (versions 4.3.0-5.8.8) is vulnerable to unauthorized remote access because its 'xwpasswd' firmware component derives Administrator passwords solely from the device MAC address and current date.Emerson XWEB EVO versions 4.3.0 through 5.8.8 contain a weak password generation vulnerability (CVE-2026-124005). The firmware component 'xwpasswd' generates daily administrative passwords using only the device MAC address and the current date, without incorporating a unique server secret. This flaw allows an attacker to reverse-engineer the algorithm by analyzing the 'xwpasswd' binary and compute valid administrator credentials offline for any affected device. This product line reached end-of-service in March 2026 and will not receive security patches.

Impact

Successful exploitation allows unauthenticated remote attackers to derive Administrator credentials, granting them full unauthorized access to the device. The lack of a secret key means the generation process is fully deterministic if the MAC address and date are known.

Recommendation

  • Since the product has reached its end of service, prioritize network isolation for all affected XWEB EVO units. Restrict management interface access to trusted internal IP ranges or VPNs.
  • Conduct an inventory of all XWEB EVO deployments and confirm firmware versions. Given the end-of-service status, migration to current, supported hardware is the primary mitigation strategy.
  • Monitor network logs for unusual, repeated administrative logins to industrial control interface ports that correlate with unauthorized remote sources.
]]>highadvisory