Threats tagged 'ghsa-xwmr-hvw2-h494'

XWEB EVO versions 4.3.0 through 5.8.8 have a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date. The password generator is embedded in the firmware binary 'xwpasswd', enabling offline computation of valid Administrator credentials without needing a server secret. This product line reached end of service in March 2026.