{"id":"CVE-2026-124013","kind":"vulnerability","aliases":["CVE-2026-124013"],"related":[],"title":"XWEB EVO: authenticated users can run root commands via api.lua","description":"XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO 5.6.2 through 5.8.8 passes server URL and credential fields unescaped into a root curl command run through io.popen in api.lua. A logged-in user can inject shell commands and run them as root on the device.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"XWEB EVO","fixed":[],"affected":">= 5.6.2, <= 5.8.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["auth-required","end-of-life","infrastructure","self-hosted","xweb-evo"],"not_affected_if":["auth-required","end-of-service-replaced","not-internet-exposed"],"how_to_check":"- Open the XWEB EVO admin interface and read the software version; 5.6.2 through 5.8.8 are affected per VulnCheck.\n- From a connection off the site network (e.g. phone with Wi-Fi off), browse to the site's public IP; the XWEB login page must not appear (Copeland's test).\n- Exploitation needs a valid login, so review the user list for accounts you don't recognise.","fix":"No fix: Copeland says XWEB EVO has reached End of Service and gets no security patches. Migrate to XWEB PRO (supported platform). Until then, per Copeland: remove the unit from the public internet (no port forwarding or DMZ), use a VPN for remote access, put it on a separate VLAN, restrict outbound traffic, use unique named accounts with strong passwords, restore a clean backup if compromise is suspected.","status":"open","published_at":"2026-11-12T20:18:25+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","triaged_at":"2026-11-12T20:41:56+00:00","updated_at":"2026-11-12T20:44:03+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-12T20:41:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"XWEB EVO: authenticated users can run root commands via api.lua","impact":"high","summary":"XWEB EVO 5.6.2 through 5.8.8 passes server URL and credential fields unescaped into a root curl command run through io.popen in api.lua. A logged-in user can inject shell commands and run them as root on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["xweb-evo","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user runs arbitrary commands as root on the device","analyst_note":"Confirm the fixed version or lack of one from the vendor and the VulnCheck advisory (www.vulncheck.com); the sources give no fix.","how_to_check":"- Check the installed XWEB EVO version in the admin interface; versions `5.6.2` through `5.8.8` are affected.\n- Confirm whether the api.lua import_preconfiguration and restore actions are reachable by authenticated users.","plain_action":"","product_name":"XWEB EVO","needs_analyst":true,"not_affected_if":["auth-required","end-of-service-replaced"],"who_is_affected":"Any XWEB EVO deployment in the affected range is exposed to a user who has valid credentials for its web or API interface. The sources do not state a fixed version, and the product line reached end of service in March 2026, so no vendor patch is confirmed. Teams should plan replacement or isolation of affected devices.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4640,"output_tokens":588,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version or lack of one from the vendor and the VulnCheck advisory (www.vulncheck.com); the sources give no fix.","search":"'-124013':13A,16A '-2026':12A,15A '2026':145C '5.6.2':35B,74C '5.8.8':37B,76C 'achiev':122C 'action':91C 'api.lua':10A,54B,86C 'arbitrari':123C 'attack':111C 'auth':20B 'auth-requir':19B 'authent':3A,79C 'command':8A,49B,63B,81C,107C,116C,124C 'concaten':101C 'contain':77C 'credenti':42B,98C 'curl':48B,106C 'cve':11A,14A 'date':142C 'devic':71B 'end':23B,139C 'end-of-lif':22B 'evo':2A,18A,32B,34B,73C 'execut':108C,125C 'field':43B,99C 'host':29B 'import':87C 'infrastructur':26B 'inject':61B,82C,113C 'io.popen':52B,110C 'life':25B 'line':135C 'log':57B 'logged-in':56B 'malici':114C 'march':144C 'os':80C 'paramet':120C 'pass':38B 'preconfigur':88C 'privileg':128C 'product':134C 'reach':136C 'relat':96C 'requir':21B 'restor':90C 'root':7A,47B,68B,105C,127C 'run':6A,50B,65B 'self':28B 'self-host':27B 'server':39B,93C,97C 'servic':141C 'shell':62B,115C 'system':132C 'under':131C 'unescap':44B,102C 'unfilt':119C 'url':40B,94C 'user':4A,59B 'via':9A,109C 'vulner':83C 'xweb':1A,17A,31B,33B,72C 'xweb-evo':30B","nicknames":[],"mitigations":[],"who_affected":"Any XWEB EVO unit (Copeland/Dixell refrigeration monitoring supervisor) running 5.6.2 to 5.8.8, per VulnCheck, is exposed to anyone with a valid login to its web interface, who can run commands as root. Internet-reachable units are most at risk. Copeland's 3 Nov 2026 bulletin says it is aware of a vulnerability in EVO and outdated XWEB PRO, but does not name this CVE. Skip it only if you have no XWEB EVO, or units sit on a local network with trusted users only.","tier":"B","verified":{"fix":{"at":"2026-11-12T20:44:03Z","by":"analyst","doc":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-api-lua","run_id":3777}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["evo","xwebevo"],"ptokens":["evo","xweb"],"labels":["authrequired","endoflife","high","infrastructure","selfhosted","vendor","xwebevo"],"campaign_type":null,"search_a":"'-124013':13A,16A '-2026':12A,15A 'api.lua':10A 'authent':3A 'command':8A 'cve':11A,14A 'evo':2A,18A 'root':7A 'run':6A 'user':4A 'via':9A 'xweb':1A,17A","search_b":"'5.6.2':35B '5.8.8':37B 'api.lua':54B 'auth':20B 'auth-requir':19B 'command':49B,63B 'credenti':42B 'curl':48B 'devic':71B 'end':23B 'end-of-lif':22B 'evo':32B,34B 'field':43B 'host':29B 'infrastructur':26B 'inject':61B 'io.popen':52B 'life':25B 'log':57B 'logged-in':56B 'pass':38B 'requir':21B 'root':47B,68B 'run':50B,65B 'self':28B 'self-host':27B 'server':39B 'shell':62B 'unescap':44B 'url':40B 'user':59B 'xweb':31B,33B 'xweb-evo':30B","search_c":"'2026':145C '5.6.2':74C '5.8.8':76C 'achiev':122C 'action':91C 'api.lua':86C 'arbitrari':123C 'attack':111C 'authent':79C 'command':81C,107C,116C,124C 'concaten':101C 'contain':77C 'credenti':98C 'curl':106C 'date':142C 'end':139C 'evo':73C 'execut':108C,125C 'field':99C 'import':87C 'inject':82C,113C 'io.popen':110C 'line':135C 'malici':114C 'march':144C 'os':80C 'paramet':120C 'preconfigur':88C 'privileg':128C 'product':134C 'reach':136C 'relat':96C 'restor':90C 'root':105C,127C 'server':93C,97C 'servic':141C 'shell':115C 'system':132C 'under':131C 'unescap':102C 'unfilt':119C 'url':94C 'via':109C 'vulner':83C 'xweb':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124013","severity":null,"published_at":"2026-11-12T20:18:25+00:00","modified_at":"2026-11-12T20:18:25+00:00","first_seen_at":"2026-11-12T20:40:25+00:00","fetched_at":"2026-11-12T20:40:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124013:3777","url":"https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","severity":null,"published_at":"2026-11-12T20:44:03+00:00","modified_at":"2026-11-12T20:44:03+00:00","first_seen_at":"2026-11-12T20:44:03+00:00","fetched_at":"2026-11-12T20:44:03+00:00","note":"VulnCheck gives range 5.6.2-5.8.8 (credit Chocapikk); Copeland Nov 2026 bulletin confirms EVO end of service, no patches, plus mitigations; bulletin does not cite this CVE. No exploitation of this CVE stated, though CERT-FR/NCSC report attacks on exposed XWEB-family controllers.","cites":["https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/"]}],"documents":[{"id":138271,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-api-lua","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":138422,"url":"https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf","title":"Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":138423,"url":"https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/","title":"France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}