---
id: "CVE-2026-124013"
page: "https://infrastack.ai/live/CVE-2026-124013"
kind: "vulnerability"
aliases: ["CVE-2026-124013"]
title: "XWEB EVO: authenticated users can run root commands via api.lua"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "XWEB EVO", "fixed": [], "affected": ">= 5.6.2, <= 5.8.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["auth-required", "end-of-life", "infrastructure", "self-hosted", "xweb-evo"]
not_affected_if: ["auth-required", "end-of-service-replaced", "not-internet-exposed"]
published_at: "2026-11-12T20:18:25+00:00"
first_seen_at: "2026-11-12T20:40:25+00:00"
updated_at: "2026-11-12T20:44:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124013", "first_seen_at": "2026-11-12T20:40:25+00:00"}, {"source": "analyst", "url": "https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/", "first_seen_at": "2026-11-12T20:44:03+00:00", "cites": ["https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/", "https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf"]}]
exploit_sources: []
---

# XWEB EVO: authenticated users can run root commands via api.lua

Link for people: https://infrastack.ai/live/CVE-2026-124013 (this .md is for agents)

XWEB EVO 5.6.2 through 5.8.8 passes server URL and credential fields unescaped into a root curl command run through io.popen in api.lua. A logged-in user can inject shell commands and run them as root on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:XWEB EVO affected >= 5.6.2, <= 5.8.8 fixed no fixed version listed

## How to check

- Open the XWEB EVO admin interface and read the software version; 5.6.2 through 5.8.8 are affected per VulnCheck.
- From a connection off the site network (e.g. phone with Wi-Fi off), browse to the site's public IP; the XWEB login page must not appear (Copeland's test).
- Exploitation needs a valid login, so review the user list for accounts you don't recognise.

## Fix

No fix: Copeland says XWEB EVO has reached End of Service and gets no security patches. Migrate to XWEB PRO (supported platform). Until then, per Copeland: remove the unit from the public internet (no port forwarding or DMZ), use a VPN for remote access, put it on a separate VLAN, restrict outbound traffic, use unique named accounts with strong passwords, restore a clean backup if compromise is suspected.

## Timeline

- 2026-11-12T20:40:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124013
- 2026-11-12T20:44:03+00:00 analyst https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/ — VulnCheck gives range 5.6.2-5.8.8 (credit Chocapikk); Copeland Nov 2026 bulletin confirms EVO end of service, no patches, plus mitigations; bulletin does not cite this CVE. No exploitation of this CVE stated, though CERT-FR/NCSC report attacks on exposed XWEB-family controllers.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-os-command-injection-via-api-lua
- [mentions] France tells refrigeration operators to go offline as Copeland ends XWEB EVO patches https://www.ctol.digital/news/refrigeration-controller-attacks-cert-fr-xweb-evo-end-of-service/
- [mitigation] Copeland Product Bulletin: Security advisory for XWEB monitoring systems (3 Nov 2026) https://www.dxl.com.pl/upload/upload/Biuletyny%202026/XWEB%20Security%20advisory%20-%20Product_Bulletin_November_2026.pdf

## From the sources

XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_