Threats tagged 'ghsa-377h-qxrj-gfvj'

XWEB EVO versions 5.6.2 through 5.8.8 contain a hardcoded credential vulnerability involving the Administrator web account. The account uses a daily password mode without a stored password, allowing the authentication function to synthesize credentials without validating a secret. An attacker who can derive the MAC-based daily password can gain full administrative access. This product line will reach end of service in March 2026.