XWEB EVO: Pre-authentication OS command injection (CVE-2026-124007)
XWEB EVO contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field.
CVE search metadata
CVE search record: CVE-2026-124007. Severity: high. CVSS: 8.1. KEV: no. Product: XWEB EVO (< 5.6.2). Brief: XWEB EVO: Pre-authentication OS command injection (CVE-2026-124007). Brief link: https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124007/
Triage facts
Revision 1- Applicability
- XWEB EVO (< 5.6.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 20:49 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
XWEB EVO contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached its end of service date in March 2026.
Impact
Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands as root.