{"id":"CVE-2026-124008","kind":"vulnerability","aliases":["CVE-2026-124008"],"related":[],"title":"XWEB EVO (end of service): logged-in users can run root commands through device template handling","description":"XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit this flaw through the wlua interpreter to execute arbitrary commands with root privileges on the affected device. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO devices from 5.2.3 through 5.8.8 let an authenticated user inject unescaped template source into shell commands in devices.lua. An attacker who is logged in can run arbitrary commands with root privileges on the device.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"XWEB EVO","fixed":[],"affected":">= 5.2.3, <= 5.8.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["end-of-service","infrastructure","iot","refrigeration","self-hosted","xweb-evo"],"not_affected_if":["not-internet-reachable","other-firmware","unauthenticated-only-access"],"how_to_check":"Any XWEB EVO is in scope. Check the firmware version in the XWEB admin interface (affected 5.2.3 through 5.8.8). Then check exposure from outside the site network (for example a phone with Wi-Fi off): the XWEB login page must not load on the site's public IP. Also look for port forwarding or DMZ rules to the unit. Also check XWEB PRO on outdated software; Copeland's bulletin names it in the wider vulnerability report, but this CVE lists only EVO.","fix":"No fixed firmware: Copeland's 3 Nov 2026 bulletin says XWEB EVO is end of service and gets no security patches; it recommends migrating to XWEB PRO (supported, v1.16.1 current). Until then, take the unit off the public internet.","status":"open","published_at":"2026-11-12T20:18:23+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","triaged_at":"2026-11-12T20:42:00+00:00","updated_at":"2026-11-12T20:45:02+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-12T20:42:00Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"XWEB EVO: authenticated attackers run root commands through device template handling","impact":"high","summary":"XWEB EVO devices from 5.2.3 through 5.8.8 let an authenticated user inject unescaped template source into shell commands in devices.lua. An attacker who is logged in can run arbitrary commands with root privileges on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["xweb-evo","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gets root command execution on the device","analyst_note":"Confirm whether a fixed firmware exists given end of service in March 2026; check the vulncheck advisory for the exact exposed interface and any vendor guidance.","how_to_check":"- Check the XWEB EVO firmware version in the device admin interface and compare it with the affected range 5.2.3 through 5.8.8\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unauthenticated-only-access","other-firmware"],"who_is_affected":"Owners of XWEB EVO devices running firmware 5.2.3 through 5.8.8 are exposed, and the attacker must hold a valid login on the device. The sources note the product line reached end of service in March 2026, so a vendor fix may not be coming; the sources do not say whether one exists. Systems not running this product line are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4633,"output_tokens":548,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed firmware exists given end of service in March 2026; check the vulncheck advisory for the exact exposed interface and any vendor guidance.","search":"'-124008':20A,23A '-2026':19A,22A '2026':143C '5.2.3':43B,77C '5.8.8':45B,79C 'affect':129C 'allow':93C 'arbitrari':67B,98C,122C 'attack':60B,95C,111C 'authent':48B,82C,94C 'command':13A,56B,68B,84C,99C,110C,123C 'contain':80C 'cve':18A,21A 'date':140C 'devic':15A,41B,74B,130C 'devices.lua':58B,89C 'end':3A,27B,137C 'end-of-servic':26B 'evo':2A,25A,38B,40B,76C 'execut':97C,121C 'exploit':113C 'flaw':115C 'handl':17A,91C 'host':35B 'infrastructur':30B 'inject':50B,85C,101C 'interpret':119C 'iot':31B 'let':46B 'line':133C 'log':7A,63B 'logged-in':6A 'march':142C 'os':83C 'privileg':71B,126C 'product':132C 'reach':134C 'refriger':32B 'relat':108C 'root':12A,70B,125C 'run':11A,66B 'self':34B 'self-host':33B 'servic':5A,29B,139C 'shell':55B,109C 'sourc':53B,104C 'templat':16A,52B,90C,103C 'unescap':51B,102C 'unzip':106C 'user':9A,49B 'vulner':86C 'wlua':118C 'xweb':1A,24A,37B,39B,75C 'xweb-evo':36B","nicknames":[],"mitigations":[],"who_affected":"Owners of XWEB EVO devices running firmware 5.2.3 through 5.8.8 are exposed, and the attacker must hold a valid login on the device. The sources note the product line reached end of service in March 2026, so a vendor fix may not be coming; the sources do not say whether one exists. Systems not running this product line are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["evo","xwebevo"],"ptokens":["evo","xweb"],"labels":["endofservice","high","infrastructure","iot","refrigeration","selfhosted","xwebevo"],"campaign_type":null,"search_a":"'-124008':20A,23A '-2026':19A,22A 'command':13A 'cve':18A,21A 'devic':15A 'end':3A 'evo':2A,25A 'handl':17A 'log':7A 'logged-in':6A 'root':12A 'run':11A 'servic':5A 'templat':16A 'user':9A 'xweb':1A,24A","search_b":"'5.2.3':43B '5.8.8':45B 'arbitrari':67B 'attack':60B 'authent':48B 'command':56B,68B 'devic':41B,74B 'devices.lua':58B 'end':27B 'end-of-servic':26B 'evo':38B,40B 'host':35B 'infrastructur':30B 'inject':50B 'iot':31B 'let':46B 'log':63B 'privileg':71B 'refriger':32B 'root':70B 'run':66B 'self':34B 'self-host':33B 'servic':29B 'shell':55B 'sourc':53B 'templat':52B 'unescap':51B 'user':49B 'xweb':37B,39B 'xweb-evo':36B","search_c":"'2026':143C '5.2.3':77C '5.8.8':79C 'affect':129C 'allow':93C 'arbitrari':98C,122C 'attack':95C,111C 'authent':82C,94C 'command':84C,99C,110C,123C 'contain':80C 'date':140C 'devic':130C 'devices.lua':89C 'end':137C 'evo':76C 'execut':97C,121C 'exploit':113C 'flaw':115C 'handl':91C 'inject':85C,101C 'interpret':119C 'line':133C 'march':142C 'os':83C 'privileg':126C 'product':132C 'reach':134C 'relat':108C 'root':125C 'servic':139C 'shell':109C 'sourc':104C 'templat':90C,103C 'unescap':102C 'unzip':106C 'vulner':86C 'wlua':118C 'xweb':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124008","severity":null,"published_at":"2026-11-12T20:18:23+00:00","modified_at":"2026-11-12T20:18:23+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","fetched_at":"2026-11-12T20:40:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124008:3779","url":"https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","severity":null,"published_at":"2026-11-12T20:45:02+00:00","modified_at":"2026-11-12T20:45:02+00:00","first_seen_at":"2026-11-12T20:45:02+00:00","fetched_at":"2026-11-12T20:45:02+00:00","note":"VulnCheck advisory (credit Chocapikk) gives range 5.2.3-5.8.8, CWE-78, needs authentication. Copeland bulletin 3 Nov 2026 confirms EVO is end of service with no patches; it does not name this CVE or say whether it is the vulnerability behind the French supermarket compromises (CERT-FR, CCB). So exploited stays false. Vendor guidance: remove from the internet, use a VPN, segment, migrate to XWEB PRO. Nothing marked verified: the bulletin is generic and does not name this CVE.","cites":["https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","https://www.bacs.admin.ch/en/warnung-kuehlanlagen-en"]}],"documents":[{"id":138265,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-devices-lua","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":138422,"url":"https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","title":"Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":138446,"url":"https://www.bacs.admin.ch/en/warnung-kuehlanlagen-en","title":"Swiss NCSC: Cooling and refrigeration control systems","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}