---
id: "CVE-2026-124008"
page: "https://infrastack.ai/live/CVE-2026-124008"
kind: "vulnerability"
aliases: ["CVE-2026-124008"]
title: "XWEB EVO (end of service): logged-in users can run root commands through device template handling"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "XWEB EVO", "fixed": [], "affected": ">= 5.2.3, <= 5.8.8", "ecosystem": "vendor"}]
ecosystems: []
tags: ["end-of-service", "infrastructure", "iot", "refrigeration", "self-hosted", "xweb-evo"]
not_affected_if: ["not-internet-reachable", "other-firmware", "unauthenticated-only-access"]
published_at: "2026-11-12T20:18:23+00:00"
first_seen_at: "2026-11-12T20:40:25+00:00"
updated_at: "2026-11-12T20:45:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124008", "first_seen_at": "2026-11-12T20:40:25+00:00"}, {"source": "analyst", "url": "https://www.bacs.admin.ch/en/warnung-kuehlanlagen-en", "first_seen_at": "2026-11-12T20:45:02+00:00", "cites": ["https://www.bacs.admin.ch/en/warnung-kuehlanlagen-en", "https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf"]}]
exploit_sources: []
---

# XWEB EVO (end of service): logged-in users can run root commands through device template handling

Link for people: https://infrastack.ai/live/CVE-2026-124008 (this .md is for agents)

XWEB EVO devices from 5.2.3 through 5.8.8 let an authenticated user inject unescaped template source into shell commands in devices.lua. An attacker who is logged in can run arbitrary commands with root privileges on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:XWEB EVO affected >= 5.2.3, <= 5.8.8 fixed no fixed version listed

## How to check

Any XWEB EVO is in scope. Check the firmware version in the XWEB admin interface (affected 5.2.3 through 5.8.8). Then check exposure from outside the site network (for example a phone with Wi-Fi off): the XWEB login page must not load on the site's public IP. Also look for port forwarding or DMZ rules to the unit. Also check XWEB PRO on outdated software; Copeland's bulletin names it in the wider vulnerability report, but this CVE lists only EVO.

## Fix

No fixed firmware: Copeland's 3 Nov 2026 bulletin says XWEB EVO is end of service and gets no security patches; it recommends migrating to XWEB PRO (supported, v1.16.1 current). Until then, take the unit off the public internet.

## Timeline

- 2026-11-12T20:40:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124008
- 2026-11-12T20:45:02+00:00 analyst https://www.bacs.admin.ch/en/warnung-kuehlanlagen-en — VulnCheck advisory (credit Chocapikk) gives range 5.2.3-5.8.8, CWE-78, needs authentication. Copeland bulletin 3 Nov 2026 confirms EVO is end of service with no patches; it does not name this CVE or say whether it is the vulnerability behind the French supermarket compromises (CERT-FR, CCB). So exploited stays false. Vendor guidance: remove from the internet, use a VPN, segment, migrate to XWEB PRO. Nothing marked verified: the bulletin is generic and does not name this CVE.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-devices-lua
- [mentions] Swiss NCSC: Cooling and refrigeration control systems https://www.bacs.admin.ch/en/warnung-kuehlanlagen-en
- [mitigation] Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026) https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf

## From the sources

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit this flaw through the wlua interpreter to execute arbitrary commands with root privileges on the affected device. This product line reached it's end of service date in March 2026.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_