← CVE Radar
CVE-2026-124004Dixell/Copeland XWEB EVO Hardcoded Administrator Backdoor Password
XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026.
9.3 CRITICALNot in KEVNVD: Deferred
Overview
Severity
| Score | Severity | Version | Technologies Affected |
|---|---|---|---|
| 9.3 | CRITICAL | 4.0VulnCheck (CNA) | Copeland XWEB EVO |
| 9.8 | CRITICAL | 3.1VulnCheck (CNA) |
Details
- CVE ID
- CVE-2026-124004
- Status
- Deferred
- Assigner (CNA)
- VulnCheck
- Published
- Nov 12, 2026
- Last modified
- 2026-11-12 21:36 UTC
- Weaknesses
- CWE-798 · Use of Hard-coded Credentials
Affected Products
As published by the CNA in the CVE record.
CopelandXWEB EVO1 version range
- before 5.6.2
References
- webapps.copeland.com https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate
- webapps.copeland.com https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf
- vulncheck.com https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-hardcoded-administrator-backdoor-password