XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Copeland
  • Xweb Evo

No data.

No data.

References
Link Providers
https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate cve-icon cve-icon
https://webapps.copeland.com/dixell/Content/Pages/AdvertisingMaterials/ProductNews/XWEB%20EVO%20EoS%20-%20Product_Bulletin_March_2026.pdf cve-icon cve-icon
https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-information-disclosure-via-sysinfo-lua cve-icon cve-icon
History

Fri, 13 Nov 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Copeland
Copeland xweb Evo
Vendors & Products Copeland
Copeland xweb Evo

Thu, 12 Nov 2026 20:15:00 +0000

Type Values Removed Values Added
Description XWEB EVO 5.6.2 through 5.8.8 contain an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.

Thu, 12 Nov 2026 20:00:00 +0000

Type Values Removed Values Added
Description XWEB EVO 5.6.2 through 5.8.8 contain an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device.
Title Dixell/Copeland XWEB EVO Information Disclosure via sysinfo.lua
Weaknesses CWE-497
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-11-12T19:59:37.292Z

Updated: 2026-11-13T00:26:35.263Z

Reserved: 2026-11-06T18:38:38.543Z

Link: CVE-2026-124011

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-12T20:18:24.670

Modified: 2026-11-13T02:18:51.030

Link: CVE-2026-124011

cve-icon Redhat

No data.