Threats tagged 'ghsa-hp68-2m45-hqr3'

XWEB EVO versions through 5.8.8 have a vulnerability in their credential generation process that allows attackers to predict and derive the Linux root password. Before version 5.7.0, the root password was identical across all units, and from 5.7.0 onward, it remains derivable from a MAC-based daily password. This flaw enables unauthorized root access to the underlying operating system. The product line reached its end of service in March 2026.