XWEB EVO · CVE-2026-124009 · Infrastructure
NO FIX YET · SEE WHAT TO DO
XWEB EVO 5.2.3 through 5.8.8 builds shell commands from the backup output device path without escaping (backup.lua, also via setuid xwbackup.cgi and xwrestore.cgi). A logged-in user can run commands as root. The product is end of service and Copeland has published no patch; its bulletins tell customers to take units off the internet and move to XWEB PRO.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Anyone running a Dixell/Copeland XWEB EVO refrigeration and HVAC monitoring unit on firmware 5.2.3 to 5.8.8. An attacker needs a login (high privilege), then can inject shell commands through the backup output device path and run them as root. Units not reachable from outside the local network and with trusted accounts are at much lower risk.
Not affected if auth-required, not-internet-exposed, outside-affected-versions
Who cares copeland, dixell, end-of-life, internet-exposed, ot, refrigeration, xweb-evo
5.2.3 through 5.8.8 is affectedXWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped concatenation into mount, unzip, and related shell commands run via the wlua interpreter, including through the setuid xwbackup.cgi and xwrestore.cgi interfaces, to achieve full system compromise. This product line reached it's end of service date in March 2026.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.