---
id: "CVE-2026-124010"
page: "https://infrastack.ai/live/CVE-2026-124010"
kind: "vulnerability"
aliases: ["CVE-2026-124010"]
title: "XWEB EVO: unauthenticated command injection gives root code execution"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "XWEB EVO", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["embedded-device", "infrastructure", "xwconsole-cgi", "xweb-evo"]
not_affected_if: ["cgi-not-reachable", "version-5.6.2-or-later"]
published_at: "2026-11-12T20:18:24+00:00"
first_seen_at: "2026-11-12T20:40:25+00:00"
updated_at: "2026-11-12T20:41:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124010", "first_seen_at": "2026-11-12T20:40:25+00:00"}]
exploit_sources: []
---

# XWEB EVO: unauthenticated command injection gives root code execution

Link for people: https://infrastack.ai/live/CVE-2026-124010 (this .md is for agents)

XWEB EVO before 5.6.2 passes the sh parameter of the setuid-root CGI xwconsole.cgi unsanitized into popen(). An unauthenticated remote attacker can run arbitrary commands as root and fully compromise the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:XWEB EVO affected range not listed fixed no fixed version listed

## How to check

- Check the installed XWEB EVO version against `5.6.2`; anything lower is in the affected range.
- Look for the `xwconsole.cgi` endpoint on the web interface exposed to the network.

## Fix

- XWEB EVO: move to `5.6.2` or later.

## Timeline

- 2026-11-12T20:40:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124010

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-command-injection-via-xwconsole-cgi

## From the sources

XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_