External risk intelligence

XWEB EVO Hardcoded Backdoor Password Allows Full Admin Access

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-124004

XWEB EVO is a monitoring and control platform designed for building and facility management, typically deployed as an internet-facing gateway or appliance to allow remote oversight of connected systems. Because it serves as a management interface and web-based portal, it is commonly exposed to the public internet by design to facilitate remote access, making the administrative surface highly reachable.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in XWEB EVO software, which is used for monitoring and control in building and facility management. This issue allows attackers to gain full administrative control using a pre-set password, posing a risk to systems managed by this technology. While the product has reached its end of service, confirming relevance and exposure remains a priority.

Unauthorized access to administrative controls is possible.
Product reached end-of-service; confirm relevance and exposure.
Prioritize confirmation of affected systems.

Attack Path

How an attacker could exploit the issue

Attackers can exploit a hardcoded backdoor password to gain administrative access to the XWEB EVO system. This vulnerability allows unauthenticated remote attackers to authenticate as the built-in Administrator account and take full control of the application. Since the product has reached its end of service, there may be no official patches available.

No authentication required for access.
Hardcoded password used in a single request.
Full administrative control over the application.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated remote attackers to gain full administrative access to the XWEB EVO application by using a hardcoded password. This could lead to unauthorized control and modification of the application's functions and data.

Application administrative access.
Via a single unauthenticated request.
Full control over the application.

Operational Fix

Recommended remediation, mitigation, and detection steps

The XWEB EVO, a monitoring and control platform, is vulnerable due to a hardcoded backdoor password. Given its typical deployment as an internet-facing gateway for remote system oversight, responsibility likely falls to application owners and network/security teams to identify instances, assess their reachability and criticality, and coordinate with vendor management for remediation, especially since the product has reached its end of service.

Application owners should manage the issue.
Verify external reachability and business impact.
Plan vendor-coordinated decommissioning or isolation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is XWEB EVO?

XWEB EVO is a monitoring and control platform, often deployed as an appliance or gateway to manage facility and building systems. It provides a web-based interface for remote oversight of connected equipment like HVAC or refrigeration controllers.

What does CWE-798 mean for CVE-2026-124004?

CWE-798 refers to the use of hardcoded credentials. In this specific vulnerability, the software contains a hidden, built-in password that allows anyone to authenticate as the Administrator. Because this password is set by the vendor and cannot be changed by the user, it serves as a backdoor for unauthorized access.

How can an attacker trigger this vulnerability?

An attacker can gain full administrative control by sending a single network request to the application using the hardcoded password. This exploit does not require the attacker to have an existing account, legitimate credentials, or any prior interaction with the system to succeed.

Do I need to worry if my XWEB EVO is internal?

Halo Surface Signal indicates that XWEB EVO is frequently deployed as an internet-facing gateway to enable remote access, making it highly reachable. While internal systems may face lower immediate risk from external attackers, the presence of a hardcoded backdoor remains a severe concern regardless of network placement.

What should I do now that XWEB EVO is end-of-service?

Since the product reached its end of service in March 2026, official security patches are unavailable. You should immediately identify all instances in your environment, verify their reachability, and prioritize decommissioning these devices or isolating them from the network to prevent unauthorized access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.