What is the fix for CVE-2026-124013?

No fix: Copeland says XWEB EVO has reached End of Service and gets no security patches. Migrate to XWEB PRO (supported platform). Until then, per Copeland: remove the unit from the public internet (no port forwarding or DMZ), use a VPN for remote access, put it on a separate VLAN, restrict outbound traffic, use unique named accounts with strong passwords, restore a clean backup if compromise is suspected.

Post Share

HIGH8.8CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

XWEB EVO · CVE-2026-124013 · Infrastructure

XWEB EVO: authenticated users can run root commands via api.lua

Q: Who is not affected by CVE-2026-124013?

Not affected if: auth-required, end-of-service-replaced, not-internet-exposed.

NO FIX YET · SEE WHAT TO DO

XWEB EVO 5.6.2 through 5.8.8 passes server URL and credential fields unescaped into a root curl command run through io.popen in api.lua. A logged-in user can inject shell commands and run them as root on the device.

first public Nov 12, 2026 · 2 sources

Check it with your coding agent

It reads this page and tells you if your code or app is affected.

Claude CodeCodexCursorAdd to your agent

01 · Who is affected

Any XWEB EVO unit (Copeland/Dixell refrigeration monitoring supervisor) running 5.6.2 to 5.8.8, per VulnCheck, is exposed to anyone with a valid login to its web interface, who can run commands as root. Internet-reachable units are most at risk. Copeland's 3 Nov 2026 bulletin says it is aware of a vulnerability in EVO and outdated XWEB PRO, but does not name this CVE. Skip it only if you have no XWEB EVO, or units sit on a local network with trusted users only.

XWEB EVO>= 5.6.2, <= 5.8.8

Not affected if auth-required, end-of-service-replaced, not-internet-exposed

Who cares auth-required, end-of-life, self-hosted, xweb-evo

02 · How to check

Open the XWEB EVO admin interface and read the software version; 5.6.2 through 5.8.8 are affected per VulnCheck.
From a connection off the site network (e.g. phone with Wi-Fi off), browse to the site's public IP; the XWEB login page must not appear (Copeland's test).
Exploitation needs a valid login, so review the user list for accounts you don't recognise.

03 · The fix

✓ Verified Nov 12

No fix: Copeland says XWEB EVO has reached End of Service and gets no security patches
Migrate to XWEB PRO (supported platform)
Until then, per Copeland: remove the unit from the public internet (no port forwarding or DMZ), use a VPN for remote access, put it on a separate VLAN, restrict outbound traffic, use unique named accounts with strong passwords, restore a clean backup if compromise is suspected

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 12, 2026

How it unfolded

2 events · Nov 12, 2026 → Nov 12, 2026

Nov 12, 202620:40 UTCNVD CVE-2026-124013
Nov 12, 202620:44 UTCInfraStack Analyst VulnCheck gives range 5.6.2-5.8.8 (credit Chocapikk); Copeland Nov 2026 bulletin confirms EVO end of service, no patches, plus mitigations; bulletin does not cite this CVE. No exploitation of this CVE stated, though CERT-FR/NCSC report attacks on exposed XWEB-family controllers.moreless

What the sources say, verbatim

512 characters

XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026.

Sources and references

NVD: CVE-2026-124013Nov 12, 2026
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com
Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026)Mitigation · dxl.com.pl
France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

InfraStack checks it against your stack and answers on your report, with the evidence and the fix.

Run the check

Get the next XWEB EVO threat the day it hits your stack.

Start free

Post Share

HIGH8.8CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

XWEB EVO · CVE-2026-124013 · Infrastructure

XWEB EVO: authenticated users can run root commands via api.lua

NO FIX YET · SEE WHAT TO DO

first public Nov 12, 2026 · 2 sources

Check it with your coding agent

It reads this page and tells you if your code or app is affected.

Claude CodeCodexCursorAdd to your agent

01 · Who is affected

XWEB EVO>= 5.6.2, <= 5.8.8

Not affected if auth-required, end-of-service-replaced, not-internet-exposed

Who cares auth-required, end-of-life, self-hosted, xweb-evo

02 · How to check

Open the XWEB EVO admin interface and read the software version; 5.6.2 through 5.8.8 are affected per VulnCheck.
From a connection off the site network (e.g. phone with Wi-Fi off), browse to the site's public IP; the XWEB login page must not appear (Copeland's test).
Exploitation needs a valid login, so review the user list for accounts you don't recognise.

03 · The fix

✓ Verified Nov 12

No fix: Copeland says XWEB EVO has reached End of Service and gets no security patches
Migrate to XWEB PRO (supported platform)
Until then, per Copeland: remove the unit from the public internet (no port forwarding or DMZ), use a VPN for remote access, put it on a separate VLAN, restrict outbound traffic, use unique named accounts with strong passwords, restore a clean backup if compromise is suspected

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 12, 2026

How it unfolded

2 events · Nov 12, 2026 → Nov 12, 2026

Nov 12, 202620:40 UTCNVD CVE-2026-124013
Nov 12, 202620:44 UTCInfraStack Analyst VulnCheck gives range 5.6.2-5.8.8 (credit Chocapikk); Copeland Nov 2026 bulletin confirms EVO end of service, no patches, plus mitigations; bulletin does not cite this CVE. No exploitation of this CVE stated, though CERT-FR/NCSC report attacks on exposed XWEB-family controllers.moreless

What the sources say, verbatim

512 characters

Sources and references

NVD: CVE-2026-124013Nov 12, 2026
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com
Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026)Mitigation · dxl.com.pl
France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

InfraStack checks it against your stack and answers on your report, with the evidence and the fix.

Run the check

Get the next XWEB EVO threat the day it hits your stack.

Start free

XWEB EVO: authenticated users can run root commands via api.lua

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next XWEB EVO threat the day it hits your stack.

XWEB EVO: authenticated users can run root commands via api.lua

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next XWEB EVO threat the day it hits your stack.