MEDIUMCVSS v3.1 5.3Vulnerability
CVE-2026-124011
XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.00382
- Cvss score
- 5.3
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Score
- 5.3
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Cve id
- CVE-2026-124011
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-11-13T00:03:24+00:00
- Name
- CVE-2026-124011
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Published at
- 2026-11-12T20:18:24.670
- Last modified
- 2026-11-13T15:17:35.390
- Epss percentile
- 0.32797
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph