Vendor
Carel XWEB EVO versions 5.6.2 through 5.8.8 contain a hardcoded credential vulnerability in the Users.authenticate function allowing authentication as Administrator via a derived daily password.