{"id":"CVE-2026-124002","kind":"vulnerability","aliases":["CVE-2026-124002"],"related":[],"title":"XWEB EVO: unauthenticated login field lets attackers run commands as root","description":"XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO versions 5.2.3 through before 5.7.0 pass the username field into operating system commands before the password check, so shell metacharacters run on the server. Because the setuid-root wlua interpreter is reachable, an attacker can gain root and fully compromise the system.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["network-appliance","other","self-hosted","xweb-evo"],"not_affected_if":["no-external-access","not-xweb-evo"],"how_to_check":"- Check the installed XWEB EVO version in the product's admin interface or on the host; versions from `5.2.3` up to before `5.7.0` are in range\n- Look for requests to `login.lua`, `cleanout.lua`, or `api.lua` with shell metacharacters in the username field in web server logs","fix":"- XWEB EVO: move to `5.7.0` or later (the product data gives this as the fixed version)\n- The product line reached end of service in March 2026, so a fixed version may not be published; the sources do not say more","status":"open","published_at":"2026-11-12T20:18:21+00:00","first_seen_at":"2026-11-12T20:40:23+00:00","triaged_at":"2026-11-12T20:41:48+00:00","updated_at":"2026-11-12T20:41:48+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-12T20:41:48Z","model":"claude-haiku-5-5","output":{"fix":"- XWEB EVO: move to `5.7.0` or later (the product data gives this as the fixed version)\n- The product line reached end of service in March 2026, so a fixed version may not be published; the sources do not say more","reach":"internet","title":"XWEB EVO: unauthenticated login field lets attackers run commands as root","impact":"high","summary":"XWEB EVO versions 5.2.3 through before 5.7.0 pass the username field into operating system commands before the password check, so shell metacharacters run on the server. Because the setuid-root wlua interpreter is reachable, an attacker can gain root and fully compromise the system.","audience":"businesses","category":"other","nicknames":[],"who_cares":["xweb-evo","self-hosted","network-appliance"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated attacker runs commands as root, full system compromise","analyst_note":"Confirm whether a fixed release or vendor notice exists for end-of-service XWEB EVO builds; check the vulncheck advisory for the fixed-version details.","how_to_check":"- Check the installed XWEB EVO version in the product's admin interface or on the host; versions from `5.2.3` up to before `5.7.0` are in range\n- Look for requests to `login.lua`, `cleanout.lua`, or `api.lua` with shell metacharacters in the username field in web server logs","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-xweb-evo","no-external-access"],"who_is_affected":"Any organization running XWEB EVO 5.2.3 up to 5.7.0 with the web interface reachable from the network is exposed, since the flaw needs no login. Systems that do not run XWEB EVO, or where the management interface is not reachable from untrusted networks, are not affected. The product has reached end of service, so the sources give no support path beyond upgrading.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000813,"input_tokens":4660,"output_tokens":694,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124002':14A,17A '-2026':13A,16A '2026':152C '5.2.3':31B,76C '5.7.0':34B,79C 'achiev':136C 'allow':90C 'api.lua':111C 'applianc':20B 'arbitrari':96C 'attack':7A,64B,93C,117C 'authent':84C 'check':46B,115C 'cleanout.lua':109C 'combin':122C 'command':9A,42B,86C,98C,132C 'compromis':70B,139C 'contain':80C 'cve':12A,15A 'date':149C 'end':146C 'evo':2A,27B,29B,74C 'execut':95C,131C 'exploit':119C 'field':5A,38B,106C 'flaw':121C 'full':137C 'fulli':69B 'gain':66B 'host':24B 'inject':87C,100C 'interpret':60B,129C 'let':6A 'line':142C 'login':4A 'login.lua':108C 'march':151C 'metacharact':49B,102C 'network':19B 'network-appli':18B 'occur':116C 'oper':40B 'os':85C,97C 'pass':35B 'password':45B,114C 'pre':83C 'pre-authent':82C 'privileg':135C 'product':141C 'reach':143C 'reachabl':62B 'remot':92C 'root':11A,58B,67B,127C,134C 'run':8A,50B 'self':23B 'self-host':22B 'server':53B 'servic':148C 'setuid':57B,126C 'setuid-root':56B,125C 'shell':48B,101C 'system':41B,72B,138C 'unauthent':3A,91C 'usernam':37B,105C 'version':30B,75C 'vulner':88C 'wlua':59B,128C 'xweb':1A,26B,28B,73C 'xweb-evo':25B","nicknames":[],"mitigations":[],"who_affected":"Any organization running XWEB EVO 5.2.3 up to 5.7.0 with the web interface reachable from the network is exposed, since the flaw needs no login. Systems that do not run XWEB EVO, or where the management interface is not reachable from untrusted networks, are not affected. The product has reached end of service, so the sources give no support path beyond upgrading.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","networkappliance","other","selfhosted","xwebevo"],"campaign_type":null,"search_a":"'-124002':14A,17A '-2026':13A,16A 'attack':7A 'command':9A 'cve':12A,15A 'evo':2A 'field':5A 'let':6A 'login':4A 'root':11A 'run':8A 'unauthent':3A 'xweb':1A","search_b":"'5.2.3':31B '5.7.0':34B 'applianc':20B 'attack':64B 'check':46B 'command':42B 'compromis':70B 'evo':27B,29B 'field':38B 'fulli':69B 'gain':66B 'host':24B 'interpret':60B 'metacharact':49B 'network':19B 'network-appli':18B 'oper':40B 'pass':35B 'password':45B 'reachabl':62B 'root':58B,67B 'run':50B 'self':23B 'self-host':22B 'server':53B 'setuid':57B 'setuid-root':56B 'shell':48B 'system':41B,72B 'usernam':37B 'version':30B 'wlua':59B 'xweb':26B,28B 'xweb-evo':25B","search_c":"'2026':152C '5.2.3':76C '5.7.0':79C 'achiev':136C 'allow':90C 'api.lua':111C 'arbitrari':96C 'attack':93C,117C 'authent':84C 'check':115C 'cleanout.lua':109C 'combin':122C 'command':86C,98C,132C 'compromis':139C 'contain':80C 'date':149C 'end':146C 'evo':74C 'execut':95C,131C 'exploit':119C 'field':106C 'flaw':121C 'full':137C 'inject':87C,100C 'interpret':129C 'line':142C 'login.lua':108C 'march':151C 'metacharact':102C 'occur':116C 'os':85C,97C 'password':114C 'pre':83C 'pre-authent':82C 'privileg':135C 'product':141C 'reach':143C 'remot':92C 'root':127C,134C 'servic':148C 'setuid':126C 'setuid-root':125C 'shell':101C 'system':138C 'unauthent':91C 'usernam':105C 'version':75C 'vulner':88C 'wlua':128C 'xweb':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124002","severity":null,"published_at":"2026-11-12T20:18:21+00:00","modified_at":"2026-11-12T20:18:21+00:00","first_seen_at":"2026-11-12T20:40:23+00:00","fetched_at":"2026-11-12T20:40:23+00:00","note":null}],"documents":[{"id":138258,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-authentication-os-command-injection-via-username","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}