XWEB EVO: Authenticated OS Command Injection
XWEB EVO versions 5.2.3 through 5.8.8 contain an authenticated OS command injection vulnerability in backup.lua that allows attackers to execute arbitrary commands as root via vulnerable CGI interfaces.
CVE search metadata
CVE search record: CVE-2026-124009. Severity: high. CVSS: 7.2. KEV: no. Product: XWEB EVO 5.2.3 through 5.8.8. Brief: XWEB EVO: Authenticated OS Command Injection. Brief link: https://feed.craftedsignal.io/briefs/2026-11-xweb-evo-rce-cve-2026-124009/
Triage facts
Revision 1- Applicability
- XWEB EVO 5.2.3 through 5.8.8
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 22:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
XWEB EVO versions 5.2.3 through 5.8.8 are susceptible to an authenticated OS command injection vulnerability. The vulnerability exists in the backup.lua script, where the output device path parameter is unsafely concatenated into system commands executed by the wlua interpreter. Attackers with authenticated access can inject shell metacharacters to execute arbitrary commands as the root user through the setuid interfaces xwbackup.cgi and xwrestore.cgi. This product line reached its end-of-service date in March 2026.
Impact
Successful exploitation allows an authenticated attacker to achieve full system compromise by executing arbitrary commands with root privileges.
Recommendation
Organizations running these systems should move to isolate these devices from internal networks or migrate to supported platforms.
Threat Hunt
Search process execution logs for child processes (mount, unzip, or shell interpreters) spawned by the setuid binaries xwbackup.cgi or xwrestore.cgi, identifying instances where process arguments contain shell metacharacters such as semicolons, pipes, or backticks.
Data: Process execution events, Command-line arguments
Identify execution of system-level utilities (mount, unzip, etc.) that originate from the wlua interpreter or associated CGI interfaces occurring with root privileges, specifically filtering for atypical command-line inputs associated with backup or restore paths.
Data: Process user context, Process lineage/parent process, Command-line arguments