{"id":"CVE-2026-124003","kind":"vulnerability","aliases":["CVE-2026-124003"],"related":[],"title":"XWEB EVO: command injection in setuid-root CGI gives root code execution","description":"XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system(\"/usr/bin/lua \"+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO before 5.6.2 has a setuid-root Lua CGI interpreter, wlua, that passes unsanitized request input into a system() call. An attacker who reaches a .lua CGI endpoint can inject shell commands and run them with root privileges.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgi","infrastructure","lua","setuid","xweb-evo"],"not_affected_if":["cgi-endpoints-unreachable","not-xweb-evo"],"how_to_check":"- Check the installed XWEB EVO version against the fixed release, `5.6.2`.\n- Look for the `wlua` binary with the setuid bit set and reachable `.lua` CGI endpoints on the web interface.","fix":"- XWEB EVO: move to `5.6.2` or later, according to the NVD range data.\n- The product line has reached end of service in March 2026, so a fixed version may not be offered; unknown beyond that.","status":"open","published_at":"2026-11-12T20:18:21+00:00","first_seen_at":"2026-11-12T20:40:23+00:00","triaged_at":"2026-11-12T20:42:01+00:00","updated_at":"2026-11-12T20:42:01+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T20:42:01Z","model":"claude-haiku-5-5","output":{"fix":"- XWEB EVO: move to `5.6.2` or later, according to the NVD range data.\n- The product line has reached end of service in March 2026, so a fixed version may not be offered; unknown beyond that.","reach":"internet","title":"XWEB EVO: command injection in setuid-root CGI gives root code execution","impact":"high","summary":"XWEB EVO before 5.6.2 has a setuid-root Lua CGI interpreter, wlua, that passes unsanitized request input into a system() call. An attacker who reaches a .lua CGI endpoint can inject shell commands and run them with root privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["xweb-evo","cgi","lua","setuid"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands as root on the device","analyst_note":"Confirm the fixed version and end-of-service fix status from the vendor and the vulncheck advisory; confirm whether unauthenticated CGI endpoints are reachable by default.","how_to_check":"- Check the installed XWEB EVO version against the fixed release, `5.6.2`.\n- Look for the `wlua` binary with the setuid bit set and reachable `.lua` CGI endpoints on the web interface.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-xweb-evo","cgi-endpoints-unreachable"],"who_is_affected":"Any XWEB EVO deployment before 5.6.2 that exposes its web interface with CGI Lua endpoints is exposed to the injection. Deployments not running XWEB EVO, or with the CGI endpoints unreachable, can skip it. The product line is past end of service, so the vendor may not ship a fix for supported installs.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000797,"input_tokens":4629,"output_tokens":669,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124003':16A,19A '-2026':15A,18A '/usr/bin/lua':87C '2026':130C '5.6.2':30B,70C 'achiev':112C 'arbitrari':105C 'argv':88C,110C 'attack':50B,92C 'call':48B 'cgi':9A,20B,37B,55B,82C,101C 'code':12A 'command':3A,60B,73C,106C,113C 'concaten':109C 'contain':71C 'craft':94C 'cve':14A,17A 'date':127C 'end':124C 'endpoint':56B,102C 'evo':2A,26B,28B,68C 'execut':13A,85C,114C 'give':10A 'infrastructur':21B 'inject':4A,58B,74C,104C 'input':44B,91C,96C 'interpret':38B,83C 'line':120C 'lua':22B,36B,54B,81C,100C 'malici':95C 'march':129C 'pass':41B 'privileg':66B,117C 'product':119C 'reach':52B,97C,121C 'request':43B 'root':8A,11A,35B,65B,80C,116C 'run':62B 'servic':126C 'setuid':7A,23B,34B,79C 'setuid-root':6A,33B,78C 'shell':59B 'string':111C 'system':47B,86C 'unsanit':42B,90C 'vulner':75C 'wlua':39B,84C 'xweb':1A,25B,27B,67C 'xweb-evo':24B","nicknames":[],"mitigations":[],"who_affected":"Any XWEB EVO deployment before 5.6.2 that exposes its web interface with CGI Lua endpoints is exposed to the injection. Deployments not running XWEB EVO, or with the CGI endpoints unreachable, can skip it. The product line is past end of service, so the vendor may not ship a fix for supported installs.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cgi","high","infrastructure","lua","setuid","xwebevo"],"campaign_type":null,"search_a":"'-124003':16A,19A '-2026':15A,18A 'cgi':9A 'code':12A 'command':3A 'cve':14A,17A 'evo':2A 'execut':13A 'give':10A 'inject':4A 'root':8A,11A 'setuid':7A 'setuid-root':6A 'xweb':1A","search_b":"'5.6.2':30B 'attack':50B 'call':48B 'cgi':20B,37B,55B 'command':60B 'endpoint':56B 'evo':26B,28B 'infrastructur':21B 'inject':58B 'input':44B 'interpret':38B 'lua':22B,36B,54B 'pass':41B 'privileg':66B 'reach':52B 'request':43B 'root':35B,65B 'run':62B 'setuid':23B,34B 'setuid-root':33B 'shell':59B 'system':47B 'unsanit':42B 'wlua':39B 'xweb':25B,27B 'xweb-evo':24B","search_c":"'/usr/bin/lua':87C '2026':130C '5.6.2':70C 'achiev':112C 'arbitrari':105C 'argv':88C,110C 'attack':92C 'cgi':82C,101C 'command':73C,106C,113C 'concaten':109C 'contain':71C 'craft':94C 'date':127C 'end':124C 'endpoint':102C 'evo':68C 'execut':85C,114C 'inject':74C,104C 'input':91C,96C 'interpret':83C 'line':120C 'lua':81C,100C 'malici':95C 'march':129C 'privileg':117C 'product':119C 'reach':97C,121C 'root':80C,116C 'servic':126C 'setuid':79C 'setuid-root':78C 'string':111C 'system':86C 'unsanit':90C 'vulner':75C 'wlua':84C 'xweb':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124003","severity":null,"published_at":"2026-11-12T20:18:21+00:00","modified_at":"2026-11-12T20:18:21+00:00","first_seen_at":"2026-11-12T20:40:23+00:00","fetched_at":"2026-11-12T20:40:23+00:00","note":null}],"documents":[{"id":138259,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-setuid-lua-cgi-root-command-injection","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}