XWEB EVO: Authenticated OS Command Injection
XWEB EVO versions 5.2.3 through 5.8.8 contain an authenticated OS command injection vulnerability in the devices.lua template handling, allowing execution of arbitrary commands with root privileges.
CVE search metadata
CVE search record: CVE-2026-124008. Severity: high. CVSS: 7.2. KEV: no. Product: XWEB EVO 5.2.3 through 5.8.8 (5.2.3-5.8.8). Brief: XWEB EVO: Authenticated OS Command Injection. Brief link: https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-command-injection-cve-2026-124008/
Triage facts
Revision 1- Applicability
- XWEB EVO 5.2.3 through 5.8.8 (5.2.3-5.8.8)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 20:49 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
XWEB EVO versions 5.2.3 through 5.8.8 contain an authenticated OS command injection vulnerability in the devices.lua template handling. Authenticated attackers can execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. This flaw can be exploited through the wlua interpreter to execute arbitrary commands with root privileges. The product line reached its end-of-service date in March 2026.
Impact
Successful exploitation allows authenticated attackers to execute arbitrary commands with root privileges on the affected device. The vulnerability has a CVSS v3.1 base score of 7.2.
Recommendation
Users should note that the affected product line reached its end-of-service date in March 2026.