{"id":"CVE-2026-124007","kind":"vulnerability","aliases":["CVE-2026-124007"],"related":[],"title":"XWEB EVO: unauthenticated password field lets attackers run root commands","description":"XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO before 5.6.2 passes the login password unescaped into a shell command in login.lua, cleanout.lua and api.lua. An unauthenticated remote attacker who injects shell metacharacters into the password field can execute arbitrary commands, with root-level access via the setuid wlua interpreter.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","self-hosted","xweb-evo"],"not_affected_if":["xweb-evo-5.6.2-or-later"],"how_to_check":"- Check whether any XWEB EVO installation runs a version earlier than `5.6.2`\n- Confirm whether the login page or API is reachable from untrusted networks","fix":"- XWEB EVO: move to `5.6.2` or later\n- The product line reached end of service in March 2026, so a fixed release may not be available for every installation","status":"open","published_at":"2026-11-12T20:18:23+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","triaged_at":"2026-11-12T20:41:52+00:00","updated_at":"2026-11-12T20:41:52+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-12T20:41:52Z","model":"claude-haiku-5-5","output":{"fix":"- XWEB EVO: move to `5.6.2` or later\n- The product line reached end of service in March 2026, so a fixed release may not be available for every installation","reach":"internet","title":"XWEB EVO: unauthenticated password field lets attackers run root commands","impact":"high","summary":"XWEB EVO before 5.6.2 passes the login password unescaped into a shell command in login.lua, cleanout.lua and api.lua. An unauthenticated remote attacker who injects shell metacharacters into the password field can execute arbitrary commands, with root-level access via the setuid wlua interpreter.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["xweb-evo","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker runs commands as root on the device","analyst_note":"Confirm whether a fixed release exists for end-of-service XWEB EVO installs; check the vulncheck advisory for details.","how_to_check":"- Check whether any XWEB EVO installation runs a version earlier than `5.6.2`\n- Confirm whether the login page or API is reachable from untrusted networks\n- unknown for any other check, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["xweb-evo-5.6.2-or-later"],"who_is_affected":"Teams running XWEB EVO before 5.6.2 with the login interface or API reachable over the network are exposed, since the flaw needs no account. The sources describe the product line as past end of service in March 2026, so a patched release may not be offered for every deployment. Teams not running XWEB EVO can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000778,"input_tokens":4644,"output_tokens":628,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124007':13A,16A '-2026':12A,15A '2026':141C '5.6.2':27B,71C 'access':62B 'achiev':118C 'allow':82C 'api.lua':41B,116C 'arbitrari':56B,88C 'attack':7A,45B,85C,98C 'authent':76C 'cleanout.lua':39B,114C 'command':10A,36B,57B,78C,89C,122C 'contain':72C 'cve':11A,14A 'date':138C 'end':135C 'evo':2A,23B,25B,69C 'execut':55B,87C,123C 'exploit':100C 'field':5A,53B,97C 'hashpass':110C 'host':20B 'infrastructur':17B 'inject':47B,79C,91C 'interpol':103C 'interpret':67B,128C 'invoc':111C 'let':6A 'level':61B,121C 'line':131C 'login':30B 'login.lua':38B,113C 'march':140C 'metacharact':49B,93C 'os':77C 'pass':28B 'password':4A,31B,52B,96C,106C 'pre':75C 'pre-authent':74C 'product':130C 'reach':132C 'remot':44B,84C 'root':9A,60B,120C 'root-level':59B,119C 'run':8A 'self':19B 'self-host':18B 'servic':137C 'setuid':65B,126C 'shell':35B,48B,92C 'unauthent':3A,43B,83C 'unescap':32B,102C 'valu':107C 'via':63B,124C 'vulner':80C 'within':112C 'wlua':66B,127C 'xweb':1A,22B,24B,68C 'xweb-evo':21B","nicknames":[],"mitigations":[],"who_affected":"Teams running XWEB EVO before 5.6.2 with the login interface or API reachable over the network are exposed, since the flaw needs no account. The sources describe the product line as past end of service in March 2026, so a patched release may not be offered for every deployment. Teams not running XWEB EVO can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","infrastructure","selfhosted","xwebevo"],"campaign_type":null,"search_a":"'-124007':13A,16A '-2026':12A,15A 'attack':7A 'command':10A 'cve':11A,14A 'evo':2A 'field':5A 'let':6A 'password':4A 'root':9A 'run':8A 'unauthent':3A 'xweb':1A","search_b":"'5.6.2':27B 'access':62B 'api.lua':41B 'arbitrari':56B 'attack':45B 'cleanout.lua':39B 'command':36B,57B 'evo':23B,25B 'execut':55B 'field':53B 'host':20B 'infrastructur':17B 'inject':47B 'interpret':67B 'level':61B 'login':30B 'login.lua':38B 'metacharact':49B 'pass':28B 'password':31B,52B 'remot':44B 'root':60B 'root-level':59B 'self':19B 'self-host':18B 'setuid':65B 'shell':35B,48B 'unauthent':43B 'unescap':32B 'via':63B 'wlua':66B 'xweb':22B,24B 'xweb-evo':21B","search_c":"'2026':141C '5.6.2':71C 'achiev':118C 'allow':82C 'api.lua':116C 'arbitrari':88C 'attack':85C,98C 'authent':76C 'cleanout.lua':114C 'command':78C,89C,122C 'contain':72C 'date':138C 'end':135C 'evo':69C 'execut':87C,123C 'exploit':100C 'field':97C 'hashpass':110C 'inject':79C,91C 'interpol':103C 'interpret':128C 'invoc':111C 'level':121C 'line':131C 'login.lua':113C 'march':140C 'metacharact':93C 'os':77C 'password':96C,106C 'pre':75C 'pre-authent':74C 'product':130C 'reach':132C 'remot':84C 'root':120C 'root-level':119C 'servic':137C 'setuid':126C 'shell':92C 'unauthent':83C 'unescap':102C 'valu':107C 'via':124C 'vulner':80C 'within':112C 'wlua':127C 'xweb':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124007","severity":null,"published_at":"2026-11-12T20:18:23+00:00","modified_at":"2026-11-12T20:18:23+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","fetched_at":"2026-11-12T20:40:25+00:00","note":null}],"documents":[{"id":138264,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-pre-auth-os-command-injection-via-password-field","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}