---
id: "CVE-2026-124014"
page: "https://infrastack.ai/live/CVE-2026-124014"
kind: "vulnerability"
aliases: ["CVE-2026-124014"]
title: "XWEB EVO: unauthenticated remote file write alters system configuration"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "XWEB EVO", "fixed": [], "affected": ">= 4.3.0, <= 5.8.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["appliance", "copeland", "dixell", "end-of-service", "other", "refrigeration", "unauthenticated", "xweb-evo"]
not_affected_if: ["migrated-to-xweb-pro", "not-internet-exposed", "unknown"]
published_at: "2026-11-12T20:18:25+00:00"
first_seen_at: "2026-11-12T20:40:26+00:00"
updated_at: "2026-11-12T20:42:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124014", "first_seen_at": "2026-11-12T20:40:26+00:00"}, {"source": "analyst", "url": "https://strfrigro.blob.core.windows.net/ct-fileswebshop/nieuwtjes/Copeland-Xweb_Cyber-Incident_France_ENG.pdf", "first_seen_at": "2026-11-12T20:42:42+00:00", "cites": ["https://strfrigro.blob.core.windows.net/ct-fileswebshop/nieuwtjes/Copeland-Xweb_Cyber-Incident_France_ENG.pdf"]}]
exploit_sources: []
---

# XWEB EVO: unauthenticated remote file write alters system configuration

Link for people: https://infrastack.ai/live/CVE-2026-124014 (this .md is for agents)

XWEB EVO versions 4.3.0 through 5.8.8 accept an unauthenticated POST to config.lua with action=set that writes the raw request body into /etc/xwebconfig.json. An remote attacker can tamper with model and plugin settings or put the system into an unconfigured state, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:XWEB EVO affected >= 4.3.0, <= 5.8.8 fixed no fixed version listed

## How to check

Check the XWEB EVO software version (4.3.0 to 5.8.8 is affected). From a connection outside the site network (e.g. a phone off Wi-Fi), open the site's public IP in a browser: the XWEB login page must not appear. Check router for port forwarding or DMZ rules pointing at the XWEB. Review /etc/xwebconfig.json fields (model, plugin) and the unit's users and settings for unexpected changes.

## Fix

No fix: Copeland says XWEB EVO is end of service and gets no more security patches. Remove it from the internet (no port forwarding, no DMZ, no public IP), reach it only through a VPN, put it on its own VLAN, and migrate to XWEB PRO (which also must not be exposed to the internet).

## Timeline

- 2026-11-12T20:40:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124014
- 2026-11-12T20:42:42+00:00 analyst https://strfrigro.blob.core.windows.net/ct-fileswebshop/nieuwtjes/Copeland-Xweb_Cyber-Incident_France_ENG.pdf — VulnCheck advisory (read) states the flaw and EOS; Copeland 14 Oct 2026 bulletin (read) confirms XWEB EVO is end of service, no patches, and gives isolation steps. Bulletin does not name this CVE or say it is the flaw used in the France compromises reported by CERT-FR/CCB, so exploited stays false. Severity: VulnCheck rates it high 8.8 vs triage critical 9.1; left unchanged. Nothing verified: vendor page for fix status is a bulletin, not a CVE advisory.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dixell-copeland-xweb-evo-unauthenticated-configuration-write-via-config-lua
- [mitigation] Copeland product bulletin 14 Oct 2026: security advisory for XWEB monitoring systems https://strfrigro.blob.core.windows.net/ct-fileswebshop/nieuwtjes/Copeland-Xweb_Cyber-Incident_France_ENG.pdf

## From the sources

XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger a SYSTEM_NOT_CONFIGURED state via the unauthenticated action=get and action=set operations, resulting in configuration tampering and denial of service. This product line reached it's end of service date in March 2026.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_