---
id: "CVE-2026-124009"
page: "https://infrastack.ai/live/CVE-2026-124009"
kind: "vulnerability"
aliases: ["CVE-2026-124009"]
title: "XWEB EVO: authenticated users can run commands as root via backup"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "XWEB EVO", "fixed": [], "affected": ">= 5.2.3, <= 5.8.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["copeland", "dixell", "end-of-life", "infrastructure", "internet-exposed", "ot", "refrigeration", "xweb-evo"]
not_affected_if: ["auth-required", "not-internet-exposed", "outside-affected-versions"]
published_at: "2026-11-12T20:18:23+00:00"
first_seen_at: "2026-11-12T20:40:25+00:00"
updated_at: "2026-11-12T20:43:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124009", "first_seen_at": "2026-11-12T20:40:25+00:00"}, {"source": "analyst", "url": "https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/", "first_seen_at": "2026-11-12T20:43:54+00:00", "cites": ["https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/", "https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf"]}]
exploit_sources: []
---

# XWEB EVO: authenticated users can run commands as root via backup

Link for people: https://infrastack.ai/live/CVE-2026-124009 (this .md is for agents)

XWEB EVO 5.2.3 through 5.8.8 builds shell commands from the backup output device path without escaping (backup.lua, also via setuid xwbackup.cgi and xwrestore.cgi). A logged-in user can run commands as root. The product is end of service and Copeland has published no patch; its bulletins tell customers to take units off the internet and move to XWEB PRO.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:XWEB EVO affected >= 5.2.3, <= 5.8.8 fixed no fixed version listed

## How to check

Check the firmware version shown in the XWEB EVO web interface; 5.2.3 through 5.8.8 is affected. Also check whether the unit is reachable from the internet (port forward, DMZ, public IP); if so treat it as possibly compromised and review user accounts, parameters and alarm settings.

## Fix

No fix: XWEB EVO reached end of service in March 2026 and Copeland says it gets no more security patches. Replace with the supported XWEB PRO. Until then remove internet exposure, restrict access by firewall, and use a VPN for remote access.

## Timeline

- 2026-11-12T20:40:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124009
- 2026-11-12T20:43:54+00:00 analyst https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/ — VulnCheck advisory read (CVSS v4 8.6, credit Chocapikk). Copeland bulletins (Nov 2026) via search snippets: EVO EoS, no patches, mitigations only; not fully read, so nothing marked verified. No exploitation evidence for this CVE specifically, though CERT-FR reports many compromises of refrigeration controllers.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-backup-lua
- [mentions] France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/
- [mitigation] Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026) https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf

## From the sources

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped concatenation into mount, unzip, and related shell commands run via the wlua interpreter, including through the setuid xwbackup.cgi and xwrestore.cgi interfaces, to achieve full system compromise. This product line reached it's end of service date in March 2026.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_