Carel - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/carel/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 20:49:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCarel XWEB EVO: Hardcoded credential vulnerability (CVE-2026-124012)https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-hardcoded-credentials-cve-2026-124012/Thu, 12 Nov 2026 20:49:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-xweb-evo-hardcoded-credentials-cve-2026-124012/Carel XWEB EVO versions 5.6.2 through 5.8.8 contain a hardcoded credential vulnerability in the Users.authenticate function allowing authentication as Administrator via a derived daily password.Carel XWEB EVO versions 5.6.2 through 5.8.8 contain a hardcoded credential vulnerability where the Administrator web account is configured to use 'daily_password' mode. The vulnerability exists in the 'Users.authenticate' function within 'lualib_users.lua', which synthesizes the Administrator configuration without validating a stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached its end-of-service date in March 2026.

Impact

Successful authentication as Administrator provides a full administrative session on the device.

Recommendation

This product reached its end-of-service date in March 2026.

]]>highadvisory