{"id":"CVE-2026-124010","kind":"vulnerability","aliases":["CVE-2026-124010"],"related":[],"title":"XWEB EVO: unauthenticated command injection gives root code execution","description":"XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO before 5.6.2 passes the sh parameter of the setuid-root CGI xwconsole.cgi unsanitized into popen(). An unauthenticated remote attacker can run arbitrary commands as root and fully compromise the device.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"XWEB EVO","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["embedded-device","infrastructure","xwconsole-cgi","xweb-evo"],"not_affected_if":["cgi-not-reachable","version-5.6.2-or-later"],"how_to_check":"- Check the installed XWEB EVO version against `5.6.2`; anything lower is in the affected range.\n- Look for the `xwconsole.cgi` endpoint on the web interface exposed to the network.","fix":"- XWEB EVO: move to `5.6.2` or later.","status":"open","published_at":"2026-11-12T20:18:24+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","triaged_at":"2026-11-12T20:41:48+00:00","updated_at":"2026-11-12T20:41:48+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-12T20:41:48Z","model":"claude-haiku-5-5","output":{"fix":"- XWEB EVO: move to `5.6.2` or later.","reach":"internet","title":"XWEB EVO: unauthenticated command injection gives root code execution","impact":"high","summary":"XWEB EVO before 5.6.2 passes the sh parameter of the setuid-root CGI xwconsole.cgi unsanitized into popen(). An unauthenticated remote attacker can run arbitrary commands as root and fully compromise the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["xweb-evo","xwconsole-cgi","embedded-device"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary commands as root on the device","analyst_note":"Confirm whether the vendor issued a fix for end-of-service installs and whether the NVD CPE range matches; check vulncheck advisory for exploitation detail.","how_to_check":"- Check the installed XWEB EVO version against `5.6.2`; anything lower is in the affected range.\n- Look for the `xwconsole.cgi` endpoint on the web interface exposed to the network.\n- unknown for other checks; the sources do not say.","plain_action":"","product_name":"XWEB EVO","needs_analyst":true,"not_affected_if":["version-5.6.2-or-later","cgi-not-reachable"],"who_is_affected":"XWEB EVO devices before 5.6.2 are exposed when the web console with the xwconsole.cgi CGI is reachable, since the flaw needs no login. Product line reached end of service in March 2026, so a patch may not be offered for every installation. unknown for other deployment conditions.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000782,"input_tokens":4615,"output_tokens":641,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124010':12A,15A '-2026':11A,14A '2026':121C '5.6.2':31B,64C 'achiev':105C 'allow':71C 'arbitrari':52B,77C 'attack':49B,74C,89C 'cgi':24B,41B,87C 'code':8A 'command':4A,53B,67C,78C 'compromis':58B,108C 'contain':65C 'cve':10A,13A 'date':118C 'devic':20B,60B 'embed':19B 'embedded-devic':18B 'end':115C 'evo':2A,17A,27B,29B,62C 'execut':9A,76C 'exploit':82C 'full':106C 'fulli':57B 'give':6A 'infrastructur':21B 'inject':5A,68C 'input':93C 'line':111C 'malici':92C 'march':120C 'paramet':35B,97C 'pass':32B,100C 'popen':45B,103C 'product':110C 'reach':112C 'remot':48B,73C 'root':7A,40B,55B,80C,86C 'run':51B 'servic':117C 'setuid':39B,85C 'setuid-root':38B,84C 'sh':34B,96C 'suppli':91C 'system':107C 'unauthent':3A,47B,72C 'unsanit':43B,101C 'vulner':69C 'xwconsol':23B 'xwconsole-cgi':22B 'xwconsole.cgi':42B,88C 'xweb':1A,16A,26B,28B,61C 'xweb-evo':25B","nicknames":[],"mitigations":[],"who_affected":"XWEB EVO devices before 5.6.2 are exposed when the web console with the xwconsole.cgi CGI is reachable, since the flaw needs no login. Product line reached end of service in March 2026, so a patch may not be offered for every installation. unknown for other deployment conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["evo","xwebevo"],"ptokens":["evo","xweb"],"labels":["critical","embeddeddevice","infrastructure","vendor","xwconsolecgi","xwebevo"],"campaign_type":null,"search_a":"'-124010':12A,15A '-2026':11A,14A 'code':8A 'command':4A 'cve':10A,13A 'evo':2A,17A 'execut':9A 'give':6A 'inject':5A 'root':7A 'unauthent':3A 'xweb':1A,16A","search_b":"'5.6.2':31B 'arbitrari':52B 'attack':49B 'cgi':24B,41B 'command':53B 'compromis':58B 'devic':20B,60B 'embed':19B 'embedded-devic':18B 'evo':27B,29B 'fulli':57B 'infrastructur':21B 'paramet':35B 'pass':32B 'popen':45B 'remot':48B 'root':40B,55B 'run':51B 'setuid':39B 'setuid-root':38B 'sh':34B 'unauthent':47B 'unsanit':43B 'xwconsol':23B 'xwconsole-cgi':22B 'xwconsole.cgi':42B 'xweb':26B,28B 'xweb-evo':25B","search_c":"'2026':121C '5.6.2':64C 'achiev':105C 'allow':71C 'arbitrari':77C 'attack':74C,89C 'cgi':87C 'command':67C,78C 'compromis':108C 'contain':65C 'date':118C 'end':115C 'evo':62C 'execut':76C 'exploit':82C 'full':106C 'inject':68C 'input':93C 'line':111C 'malici':92C 'march':120C 'paramet':97C 'pass':100C 'popen':103C 'product':110C 'reach':112C 'remot':73C 'root':80C,86C 'servic':117C 'setuid':85C 'setuid-root':84C 'sh':96C 'suppli':91C 'system':107C 'unauthent':72C 'unsanit':101C 'vulner':69C 'xwconsole.cgi':88C 'xweb':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124010","severity":null,"published_at":"2026-11-12T20:18:24+00:00","modified_at":"2026-11-12T20:18:24+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","fetched_at":"2026-11-12T20:40:25+00:00","note":null}],"documents":[{"id":138268,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-command-injection-via-xwconsole-cgi","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}