{"id":"CVE-2026-124009","kind":"vulnerability","aliases":["CVE-2026-124009"],"related":[],"title":"XWEB EVO: authenticated users can run commands as root via backup","description":"XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped concatenation into mount, unzip, and related shell commands run via the wlua interpreter, including through the setuid xwbackup.cgi and xwrestore.cgi interfaces, to achieve full system compromise. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO 5.2.3 through 5.8.8 builds shell commands from the backup output device path without escaping (backup.lua, also via setuid xwbackup.cgi and xwrestore.cgi). A logged-in user can run commands as root. The product is end of service and Copeland has published no patch; its bulletins tell customers to take units off the internet and move to XWEB PRO.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"XWEB EVO","fixed":[],"affected":">= 5.2.3, <= 5.8.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["copeland","dixell","end-of-life","infrastructure","internet-exposed","ot","refrigeration","xweb-evo"],"not_affected_if":["auth-required","not-internet-exposed","outside-affected-versions"],"how_to_check":"Check the firmware version shown in the XWEB EVO web interface; 5.2.3 through 5.8.8 is affected. Also check whether the unit is reachable from the internet (port forward, DMZ, public IP); if so treat it as possibly compromised and review user accounts, parameters and alarm settings.","fix":"No fix: XWEB EVO reached end of service in March 2026 and Copeland says it gets no more security patches. Replace with the supported XWEB PRO. Until then remove internet exposure, restrict access by firewall, and use a VPN for remote access.","status":"open","published_at":"2026-11-12T20:18:23+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","triaged_at":"2026-11-12T20:41:59+00:00","updated_at":"2026-11-12T20:43:54+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-12T20:41:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"XWEB EVO: authenticated users can run commands as root via backup","impact":"high","summary":"XWEB EVO 5.2.3 through 5.8.8 passes an output device path straight into shell commands in its backup code. A logged-in attacker can inject shell metacharacters and run arbitrary commands as root, which gives full control of the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["xweb-evo"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs commands as root, full system compromise","analyst_note":"Confirm whether a fixed version or vendor advisory exists given end of service in March 2026; check the VulnCheck advisory for fix and detection guidance.","how_to_check":"- Check the installed XWEB EVO version against the affected range 5.2.3 through 5.8.8\n- unknown for other checks: the sources do not say which settings or files to inspect","plain_action":"","product_name":"XWEB EVO","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Any XWEB EVO deployment within versions 5.2.3 through 5.8.8 is exposed, but only to someone who already has an account on the device. The sources note the product line reached end of service in March 2026, so no vendor patch may be coming. Systems running other products or versions outside the range can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000744,"input_tokens":4671,"output_tokens":554,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version or vendor advisory exists given end of service in March 2026; check the VulnCheck advisory for fix and detection guidance.","search":"'-124009':14A,17A '-2026':13A,16A '2026':173C '5.2.3':37B,97C '5.8.8':39B,99C 'achiev':157C 'allow':108C 'also':52B 'arbitrari':113C 'attack':110C,130C 'authent':3A,102C,109C 'backup':11A,45B 'backup.lua':51B,129C 'build':40B 'bulletin':81B 'command':7A,42B,65B,104C,114C,142C 'compromis':160C 'concaten':135C 'contain':100C 'copeland':20B,75B 'custom':83B 'cve':12A,15A 'date':170C 'devic':47B,124C 'dixel':21B 'end':23B,71B,167C 'end-of-lif':22B 'escap':50B 'evo':2A,19A,34B,36B,96C 'execut':112C 'exploit':132C 'expos':29B 'full':158C 'includ':148C 'infrastructur':26B 'inject':105C,118C 'interfac':155C 'internet':28B,89B 'internet-expos':27B 'interpret':147C 'life':25B 'line':163C 'log':60B 'logged-in':59B 'march':172C 'metacharact':120C 'mount':137C 'move':91B 'os':103C 'ot':30B 'output':46B,123C 'paramet':126C 'patch':79B 'path':48B,125C 'pro':94B 'process':127C 'product':69B,162C 'publish':77B 'reach':164C 'refriger':31B 'relat':140C 'root':9A,67B,116C 'run':6A,64B,143C 'servic':73B,169C 'setuid':54B,151C 'shell':41B,119C,141C 'system':159C 'take':85B 'tell':82B 'unescap':134C 'unit':86B 'unzip':138C 'user':4A,62B 'via':10A,53B,144C 'vulner':106C 'without':49B 'wlua':146C 'xwbackup.cgi':55B,152C 'xweb':1A,18A,33B,35B,93B,95C 'xweb-evo':32B 'xwrestore.cgi':57B,154C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Dixell/Copeland XWEB EVO refrigeration and HVAC monitoring unit on firmware 5.2.3 to 5.8.8. An attacker needs a login (high privilege), then can inject shell commands through the backup output device path and run them as root. Units not reachable from outside the local network and with trusted accounts are at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["evo","xwebevo"],"ptokens":["evo","xweb"],"labels":["copeland","dixell","endoflife","high","infrastructure","internetexposed","ot","refrigeration","vendor","xwebevo"],"campaign_type":null,"search_a":"'-124009':14A,17A '-2026':13A,16A 'authent':3A 'backup':11A 'command':7A 'cve':12A,15A 'evo':2A,19A 'root':9A 'run':6A 'user':4A 'via':10A 'xweb':1A,18A","search_b":"'5.2.3':37B '5.8.8':39B 'also':52B 'backup':45B 'backup.lua':51B 'build':40B 'bulletin':81B 'command':42B,65B 'copeland':20B,75B 'custom':83B 'devic':47B 'dixel':21B 'end':23B,71B 'end-of-lif':22B 'escap':50B 'evo':34B,36B 'expos':29B 'infrastructur':26B 'internet':28B,89B 'internet-expos':27B 'life':25B 'log':60B 'logged-in':59B 'move':91B 'ot':30B 'output':46B 'patch':79B 'path':48B 'pro':94B 'product':69B 'publish':77B 'refriger':31B 'root':67B 'run':64B 'servic':73B 'setuid':54B 'shell':41B 'take':85B 'tell':82B 'unit':86B 'user':62B 'via':53B 'without':49B 'xwbackup.cgi':55B 'xweb':33B,35B,93B 'xweb-evo':32B 'xwrestore.cgi':57B","search_c":"'2026':173C '5.2.3':97C '5.8.8':99C 'achiev':157C 'allow':108C 'arbitrari':113C 'attack':110C,130C 'authent':102C,109C 'backup.lua':129C 'command':104C,114C,142C 'compromis':160C 'concaten':135C 'contain':100C 'date':170C 'devic':124C 'end':167C 'evo':96C 'execut':112C 'exploit':132C 'full':158C 'includ':148C 'inject':105C,118C 'interfac':155C 'interpret':147C 'line':163C 'march':172C 'metacharact':120C 'mount':137C 'os':103C 'output':123C 'paramet':126C 'path':125C 'process':127C 'product':162C 'reach':164C 'relat':140C 'root':116C 'run':143C 'servic':169C 'setuid':151C 'shell':119C,141C 'system':159C 'unescap':134C 'unzip':138C 'via':144C 'vulner':106C 'wlua':146C 'xwbackup.cgi':152C 'xweb':95C 'xwrestore.cgi':154C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124009","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124009","severity":null,"published_at":"2026-11-12T20:18:23+00:00","modified_at":"2026-11-12T20:18:23+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","fetched_at":"2026-11-12T20:40:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124009:3778","url":"https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","severity":null,"published_at":"2026-11-12T20:43:54+00:00","modified_at":"2026-11-12T20:43:54+00:00","first_seen_at":"2026-11-12T20:43:54+00:00","fetched_at":"2026-11-12T20:43:54+00:00","note":"VulnCheck advisory read (CVSS v4 8.6, credit Chocapikk). Copeland bulletins (Nov 2026) via search snippets: EVO EoS, no patches, mitigations only; not fully read, so nothing marked verified. No exploitation evidence for this CVE specifically, though CERT-FR reports many compromises of refrigeration controllers.","cites":["https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/"]}],"documents":[{"id":138266,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-backup-lua","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":138422,"url":"https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","title":"Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":138423,"url":"https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/","title":"France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}