Threats tagged 'ghsa-ph6q-p974-r2rr'

XWEB EVO versions 5.6.2 through 5.8.8 have an information disclosure vulnerability that allows unauthenticated attackers to access the device's eth0 MAC address and system clock via the sysinfo.lua endpoint. This information can be used to offline derive the MAC-based daily password, potentially enabling unauthorized authentication. The product line is end-of-service as of March 2026.