{"id":"CVE-2026-124014","kind":"vulnerability","aliases":["CVE-2026-124014"],"related":[],"title":"XWEB EVO: unauthenticated remote file write alters system configuration","description":"XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger a SYSTEM_NOT_CONFIGURED state via the unauthenticated action=get and action=set operations, resulting in configuration tampering and denial of service. This product line reached it's end of service date in March 2026.","summary":"XWEB EVO versions 4.3.0 through 5.8.8 accept an unauthenticated POST to config.lua with action=set that writes the raw request body into /etc/xwebconfig.json. An remote attacker can tamper with model and plugin settings or put the system into an unconfigured state, causing denial of service.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"XWEB EVO","fixed":[],"affected":">= 4.3.0, <= 5.8.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["appliance","copeland","dixell","end-of-service","other","refrigeration","unauthenticated","xweb-evo"],"not_affected_if":["migrated-to-xweb-pro","not-internet-exposed","unknown"],"how_to_check":"Check the XWEB EVO software version (4.3.0 to 5.8.8 is affected). From a connection outside the site network (e.g. a phone off Wi-Fi), open the site's public IP in a browser: the XWEB login page must not appear. Check router for port forwarding or DMZ rules pointing at the XWEB. Review /etc/xwebconfig.json fields (model, plugin) and the unit's users and settings for unexpected changes.","fix":"No fix: Copeland says XWEB EVO is end of service and gets no more security patches. Remove it from the internet (no port forwarding, no DMZ, no public IP), reach it only through a VPN, put it on its own VLAN, and migrate to XWEB PRO (which also must not be exposed to the internet).","status":"open","published_at":"2026-11-12T20:18:25+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","triaged_at":"2026-11-12T20:41:56+00:00","updated_at":"2026-11-12T20:42:42+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-12T20:41:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"XWEB EVO: unauthenticated remote file write alters system configuration","impact":"medium","summary":"XWEB EVO versions 4.3.0 through 5.8.8 accept an unauthenticated POST to config.lua with action=set that writes the raw request body into /etc/xwebconfig.json. An remote attacker can tamper with model and plugin settings or put the system into an unconfigured state, causing denial of service.","audience":"businesses","category":"other","nicknames":[],"who_cares":["xweb-evo","appliance"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker rewrites system configuration and causes denial of service","analyst_note":"Confirm the vendor fix status and affected deployment details at the VulnCheck advisory and NVD entry; the product is past end of service.","how_to_check":"- unknown","plain_action":"","product_name":"XWEB EVO","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Any XWEB EVO deployment in the 4.3.0 to 5.8.8 range is exposed, because config.lua accepts requests without session validation. The product line reached end of service in March 2026, so no vendor fix is stated in the sources. Teams running XWEB EVO should look at whether the device or appliance is reachable from untrusted networks.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000738,"input_tokens":4697,"output_tokens":537,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the vendor fix status and affected deployment details at the VulnCheck advisory and NVD entry; the product is past end of service.","search":"'-124014':12A,15A '-2026':11A,14A '/etc/xwebconfig.json':53B,98C '2026':170C '4.3.0':34B,78C '5.8.8':36B,80C 'accept':37B 'action':44B,108C,144C,147C 'allow':89C 'alter':7A 'applianc':18B 'arbitrari':84C 'attack':56B,91C,122C 'bodi':51B,121C 'caus':72B 'config.lua':42B,106C 'configur':9A,96C,126C,139C,152C 'contain':81C 'copeland':19B 'craft':102C 'cve':10A,13A 'date':167C 'denial':73B,155C 'dixel':20B 'end':22B,164C 'end-of-servic':21B 'evo':2A,17A,30B,32B,77C 'field':133C 'file':5A,85C,97C 'get':145C 'line':160C 'march':169C 'model':60B,130C 'modifi':93C 'oper':149C 'perform':111C 'plugin':62B,132C 'post':40B,103C 'product':159C 'put':65B 'raw':49B,118C 'reach':161C 'refriger':26B 'remot':4A,55B,90C 'request':50B,104C,120C 'result':150C 'send':100C 'servic':24B,75B,157C,166C 'session':113C 'set':45B,63B,109C,148C 'state':71B,140C 'system':8A,67B,95C,137C 'tamper':58B,124C,153C 'trigger':135C 'unauthent':3A,27B,39B,83C,143C 'unconfigur':70B 'unvalid':119C 'valid':114C 'valu':127C 'version':33B 'via':141C 'vulner':87C 'write':6A,47B,86C,116C 'xweb':1A,16A,29B,31B,76C 'xweb-evo':28B","nicknames":[],"mitigations":[],"who_affected":"Any XWEB EVO (Copeland/Dixell refrigeration and HVAC supervisor) running 4.3.0 to 5.8.8 whose web interface can be reached by an attacker, because config.lua accepts action=set and action=get without a session check. Look at supermarket, cold-chain and food-storage sites. Units reachable only from a trusted local network or behind a VPN are far less exposed; no vendor patch exists, so the fix is isolation and migration to XWEB PRO.","tier":"B","verified":{"fix":{"at":"2026-11-12T20:42:42Z","by":"analyst","doc":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-configuration-write-via-config-lua","run_id":3771}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["evo","xwebevo"],"ptokens":["evo","xweb"],"labels":["appliance","copeland","critical","dixell","endofservice","other","refrigeration","unauthenticated","vendor","xwebevo"],"campaign_type":null,"search_a":"'-124014':12A,15A '-2026':11A,14A 'alter':7A 'configur':9A 'cve':10A,13A 'evo':2A,17A 'file':5A 'remot':4A 'system':8A 'unauthent':3A 'write':6A 'xweb':1A,16A","search_b":"'/etc/xwebconfig.json':53B '4.3.0':34B '5.8.8':36B 'accept':37B 'action':44B 'applianc':18B 'attack':56B 'bodi':51B 'caus':72B 'config.lua':42B 'copeland':19B 'denial':73B 'dixel':20B 'end':22B 'end-of-servic':21B 'evo':30B,32B 'model':60B 'plugin':62B 'post':40B 'put':65B 'raw':49B 'refriger':26B 'remot':55B 'request':50B 'servic':24B,75B 'set':45B,63B 'state':71B 'system':67B 'tamper':58B 'unauthent':27B,39B 'unconfigur':70B 'version':33B 'write':47B 'xweb':29B,31B 'xweb-evo':28B","search_c":"'/etc/xwebconfig.json':98C '2026':170C '4.3.0':78C '5.8.8':80C 'action':108C,144C,147C 'allow':89C 'arbitrari':84C 'attack':91C,122C 'bodi':121C 'config.lua':106C 'configur':96C,126C,139C,152C 'contain':81C 'craft':102C 'date':167C 'denial':155C 'end':164C 'evo':77C 'field':133C 'file':85C,97C 'get':145C 'line':160C 'march':169C 'model':130C 'modifi':93C 'oper':149C 'perform':111C 'plugin':132C 'post':103C 'product':159C 'raw':118C 'reach':161C 'remot':90C 'request':104C,120C 'result':150C 'send':100C 'servic':157C,166C 'session':113C 'set':109C,148C 'state':140C 'system':95C,137C 'tamper':124C,153C 'trigger':135C 'unauthent':83C,143C 'unvalid':119C 'valid':114C 'valu':127C 'via':141C 'vulner':87C 'write':86C,116C 'xweb':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124014","severity":null,"published_at":"2026-11-12T20:18:25+00:00","modified_at":"2026-11-12T20:18:25+00:00","first_seen_at":"2026-11-12T20:40:26+00:00","fetched_at":"2026-11-12T20:40:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124014:3771","url":"https://strfrigro.blob.core.windows.net/ct-fileswebshop/nieuwtjes/Copeland-Xweb_Cyber-Incident_France_ENG.pdf","severity":null,"published_at":"2026-11-12T20:42:42+00:00","modified_at":"2026-11-12T20:42:42+00:00","first_seen_at":"2026-11-12T20:42:42+00:00","fetched_at":"2026-11-12T20:42:42+00:00","note":"VulnCheck advisory (read) states the flaw and EOS; Copeland 14 Oct 2026 bulletin (read) confirms XWEB EVO is end of service, no patches, and gives isolation steps. Bulletin does not name this CVE or say it is the flaw used in the France compromises reported by CERT-FR/CCB, so exploited stays false. Severity: VulnCheck rates it high 8.8 vs triage critical 9.1; left unchanged. Nothing verified: vendor page for fix status is a bulletin, not a CVE advisory.","cites":["https://strfrigro.blob.core.windows.net/ct-fileswebshop/nieuwtjes/Copeland-Xweb_Cyber-Incident_France_ENG.pdf"]}],"documents":[{"id":138272,"url":"https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-configuration-write-via-config-lua","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":138425,"url":"https://strfrigro.blob.core.windows.net/ct-fileswebshop/nieuwtjes/Copeland-Xweb_Cyber-Incident_France_ENG.pdf","title":"Copeland product bulletin 14 Oct 2026: security advisory for XWEB monitoring systems","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}