XWEB EVO · CVE-2026-124008 · Infrastructure
NO FIX YET · SEE WHAT TO DO
XWEB EVO devices from 5.2.3 through 5.8.8 let an authenticated user inject unescaped template source into shell commands in devices.lua. An attacker who is logged in can run arbitrary commands with root privileges on the device.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of XWEB EVO devices running firmware 5.2.3 through 5.8.8 are exposed, and the attacker must hold a valid login on the device. The sources note the product line reached end of service in March 2026, so a vendor fix may not be coming; the sources do not say whether one exists. Systems not running this product line are not affected.
Not affected if not-internet-reachable, other-firmware, unauthenticated-only-access
Who cares end-of-service, iot, refrigeration, self-hosted, xweb-evo
5.2.3 through 5.8.8)XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit this flaw through the wlua interpreter to execute arbitrary commands with root privileges on the affected device. This product line reached it's end of service date in March 2026.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
v1.16.1This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.