XWEB EVO · CVE-2026-124010 · Infrastructure
NO FIX YET · SEE WHAT TO DO
XWEB EVO before 5.6.2 passes the sh parameter of the setuid-root CGI xwconsole.cgi unsanitized into popen(). An unauthenticated remote attacker can run arbitrary commands as root and fully compromise the device.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
XWEB EVO devices before 5.6.2 are exposed when the web console with the xwconsole.cgi CGI is reachable, since the flaw needs no login. Product line reached end of service in March 2026, so a patch may not be offered for every installation. unknown for other deployment conditions.
Not affected if cgi-not-reachable, version-5.6.2-or-later
Who cares embedded-device, xwconsole-cgi, xweb-evo
5.6.2; anything lower is in the affected range.xwconsole.cgi endpoint on the web interface exposed to the network.5.6.2 or later.XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.